Lens Protocol V2 - Bughunter101's results

Lines of code

https://github.com/code-423n4/2023-07-lens/blob/main/contracts/misc/LensV2Migration.sol#L33 https://github.com/code-423n4/2023-07-lens/blob/main/contracts/misc/LensV2Migration.sol#L37 https://github.com/code-423n4/2023-07-lens/blob/main/contracts/misc/LensV2Migration.sol#L45

Vulnerability details

Impact

In case where the governance wants to stop all activity, they still can't stop migrate. And this problem just like this: https://github.com/code-423n4/2022-02-aave-lens-findings/issues/71

Proof of Concept

As we can see, The LenHub is inherits from LensV2Migration. And all the external function of LensHub have whenNotPasued modifier. However, the LensV2Migration 's function does not have the whenNotPasued modifier.

contract LensHub is
    LensProfiles,
    LensGovernable,
    LensV2Migration,
    LensImplGetters,
    LensHubEventHooks,
    LensHubStorage,
    ILensProtocol
{

Tools Used

vs code

Recommended Mitigation Steps

add whenNotPasued to all the external function of LensV2Migration. And we can refer to this issue: https://github.com/code-423n4/2022-02-aave-lens-findings/issues/71

Assessed type

Error