VTVL contest - romand's results

Lines of code

https://github.com/code-423n4/2022-09-vtvl/blob/f68b7f3e61dad0d873b5b5a1e8126b839afeab5f/contracts/AccessProtected.sol#L39-L43

Vulnerability details

Impact

Admin can lock himself out of contract, which makes any actions with onlyAdmin modifier impossible.

Proof of Concept

  it("admin disables himself", async function () {
    const [owner] = await ethers.getSigners();

    const contract = await deployVestingContract();

    expect(await contract.isAdmin(owner.address)).to.equal(true);
    await (await contract.connect(owner).setAdmin(owner.address, false)).wait();
    expect(await contract.isAdmin(owner.address)).to.equal(false);
  });

Tools Used

VS Code

Recommended Mitigation Steps

Add check in AccessProtected.sol setAdmin function

    function setAdmin(address admin, bool isEnabled) public onlyAdmin {
        require(admin != address(0) && admin != msg.sender, "INVALID_ADDRESS");
        _admins[admin] = isEnabled;
        emit AdminAccessSet(admin, isEnabled);
    }