Admin has the authorization to update the parameter setting such as fee, epoch length, liquidation auction window, enable / disable the flashAuction, pause the protocol by calling the file function in AstariaRouter.sol, CollateralToken.sol and LienToken.sol
However, adversary can front-run admins state up.
Let me be specific, the adversay can front-run the admins disable flashAuction transaction.
note the update:
If the admin submit a transaction to disable the targets flashAction,
The adversary can watch for the transaction in mempool, and once detecting the admins transaction and decode the parameter to see admins wants to disable his flashAction right,
The adversary can submit the transaction with higher gas fee to perform flash action before the admins transaction is executed.
Same type of front-running can be performed when adversary detects that the admin wants to pause the protocol. The adversary can front-run the pause transaction to deposit fund to mint more share from the vault, or commitTolLien to start a new loan term with NFT before the pause transactoin is executed.
The adversary can in fact front-run the parameter setting update as well
For example, the adversary detects that the admin wants to make the liquidation fee lower, the adversary can front-run admins transaction by settling the liquidation and the liquidation fee payout before the admins transaction is executed.
We recommend the protocol use private RPC such as flashbot to submit transaction to avoid front-running.
