ParaSpace contest - ali_shehab's results

Lines of code

https://github.com/code-423n4/2022-11-paraspace/blob/main/paraspace-core/contracts/misc/NFTFloorOracle.sol#L167

Vulnerability details

Impact

The comments above say that inorder to be able to remove the feeder you must be the owner, however, there is no any access control implemented here. Anyone can remove any feeder.

Proof of Concept

 /// @notice Allows owner to remove feeder.
    /// @param _feeder feeder to remove
    function removeFeeder(address _feeder)
        external
        onlyWhenFeederExisted(_feeder)
    {
        _removeFeeder(_feeder);
    }

Tools Used

Recommended Mitigation Steps

Add a check that the calling is the owner.

 /// @notice Allows owner to remove feeder.
    /// @param _feeder feeder to remove
    function removeFeeder(address _feeder)
        external
        onlyWhenFeederExisted(_feeder)
        onlyRole(DEFAULT_ADMIN_ROLE)
    {
        _removeFeeder(_feeder);
    }