Kelp DAO | rsETH - 0xblackskull's results

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTConfig.sol#L73

Vulnerability details

Impact

Due to how asset are handled and stored in the LRTConfig.sol, it is not possible to remove supported assrt in LRTConfig.sol.

Proof of Concept

There is only LRTConfig:addNewSupportedAsset, what happen when manager or owner want to remove that particular asset, in this case devs should add function for removeSupportedAsset

Tools Used

Manual code review

Recommended Mitigation Steps

Provide functions in LRTConfig.sol to allow the owner or manager to clear the settings by resetting their configuration to the default value. Add this kind of function

function removeSupportedAsset(address asset) external onlyRole(LRTConstants.MANAGER) {
    delete isSupportedAsset[asset];
    emit removeSupportedAsset(asset);
}

Assessed type

Context