Kelp DAO | rsETH - baice's results

Lines of code

https://github.com/code-423n4/2023-11-kelp/blob/main/src/LRTConfig.sol#L80-#L85

Vulnerability details

Impact

If something unexpected happens to a certain token, the assets need to be dropped and cannot be cancelled.

Proof of Concept

        UtilLib.checkNonZeroAddress(asset);
        if (isSupportedAsset[asset]) {
            revert AssetAlreadySupported();
        }
        isSupportedAsset[asset] = true;
        supportedAssetList.push(asset);
        depositLimitByAsset[asset] = depositLimit;
        emit AddedNewSupportedAsset(asset, depositLimit);
    }

There is no way to set the isSupportedAsset[asset] = false ;

Tools Used

VSCode

Recommended Mitigation Steps

add new LRC Manager function to set the supported assets

Assessed type

Access Control