Inverse Finance contest - jwood's results

Lines of code

https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Market.sol#L136 https://github.com/code-423n4/2022-10-inverse/blob/3e81f0f5908ea99b36e6ab72f13488bbfe622183/src/Market.sol#L203-L206

Vulnerability details

Impact

Admin privilege issue

Gov can drain the DOLA tokens in Market.sol by setting the lender address to an arbitrary address using the setter function then calling recall()

Proof of Concept

set the lender address

 function setLender(address _lender) public onlyGov { lender = _lender; }

drain DOLA tokens using recall()

    function recall(uint amount) public {
        require(msg.sender == lender, "Only lender can recall");
        dola.transfer(msg.sender, amount);
    }