Centrifuge - btk's results

Lines of code

https://github.com/code-423n4/2023-09-centrifuge/blob/main/src/LiquidityPool.sol#L97-L100

Vulnerability details

Impact

The withApproval modifier in the contract is not functioning as intended, as it restricts access only to the owner of the assets and not to authorized administrators, which is not the expected behavior.

Proof of Concept

    /// @dev Either msg.sender is the owner or a ward on the contract
    modifier withApproval(address owner) {
        require(msg.sender == owner, "LiquidityPool/no-approval");
        _;
    }

Every function with the withApproval modifier is supposed to only be called by the Owner of the assets or an authorized admin, but with the current implementation, the function will revert if called by someone othe than the owner of the asset.

Tools Used

Manual review

Recommended Mitigation Steps

To address this isssue, we recommend updating the modifier as follow:

    /// @dev Either msg.sender is the owner or a ward on the contract
    modifier withApproval(address owner) {
        require(msg.sender == owner || wards[msg.sender] == 1, "LiquidityPool/no-approval");
        _;
    }

Assessed type

Invalid Validation