Submitted by 0xDjango
The deployFor() function in MIMOProxyFactory.sol can be called directly instead of being called within MIMOProxyRegistry.sol. This results in the ability to create many MIMOProxies that are not registered within the registry. The proxies deployed directly through the factory will lack the ability to call certain actions such as leveraging and emptying the vault, but will be able to call all functions in MIMOVaultAction.sol.
This inconsistency doesnt feel natural and would be remedied by adding an onlyRegistry modifier to the ProxyFactory.deployFor() function.
MIMOProxyFactory.deployFor() lacking any access control:
Example of reduced functionality: MIMOEmptyVault.executeOperation() checks proxy existence in the proxy registry therefore cant be called.
Adding access control to ensure that the factory deployFor function is called from the proxy registry would mitigate this issue.
RnkSngh (Mimo) confirmed and commented:
horsefacts (warden) reviewed mitigation:
