Submitted by IllIllI, also found by Kenshin
The ORDERER_ROLE role has the ability to arbitrarily transfer user funds, and this role is shared between both the orderer and people who can rebalance the index.
Even if the owner is benevolent the fact that there is a rug vector available may negatively impact the protocols reputation. See this example where a similar finding has been flagged as a high-severity issue. Ive downgraded this instance to be a medium since it requires a malicious manager.
The role is given to the orderer so it has the ability to add/remove funds during Uniswap operations:
File: contracts/vToken.sol (lines 80-87)
The role is also required to initiate rebalances:
File: contracts/TopNMarketCapIndex.sol (lines 67-68)
File: contracts/TrackedIndex.sol (lines 56-57)
It is not necessary for the person/tool initiating reweights to also have the ability to arbitrarily transfer funds, so they should be separate roles. If the orderer also needs to be able to reweight, the orderer should also be given the new role.
Split the role into two, and only give the ORDERER_ROLE role to the orderer.
olivermehr (Phuture Finance) disputed
jn-lp (Phuture Finance) commented:
moose-code (judge) commented:
