Submitted by cryptphi
The AutoRange.configToken() function updates the state variable positionConfigs for a tokenId and callable by the owner of the tokenId. However, in the call to AutoRange.execute(), the state variable positionConfigs for the tokenId is used in setting the local variable PositionConfig memory config without any further check to ensure the config has been set by the current owner of the tokenId.
This in some way could affect the swapcall on the token position such that the protocol does not receive any incentive.
https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/transformers/AutoRange.sol#L276-L297
positionConfigs state variable for tokenId is set in configToken() by token owner:
https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/transformers/AutoRange.sol#L111-L116
positionConfigs[tokenId] set by a previous tokenId owner being used:
Using an enumerable set or additional mapping parameter to set the current owner in the positionConfigs state variable and an additional check in execute() to ensure the config was set by token owner.
kalinbas (Revert) acknowledged and commented:
ronnyx2017 (judge) commented:
