Submitted by deadrxsezzz
The idea of Magnetar is to allow users to batch transactions towards certain contract within the Tapioca contracts, including TapiocaOptionBroker and TapiocaOptionLiquidityProvision. In order to do so, users will have to give oTAP and tOLP allowance to the Magnetar contract.
The problem is that within the _processTapTokenOperation function, any user could make a call for anothers users approved NFT, as there are no checks that the msg.sender is the owner of the NFT.
Example: A user can call exerciseOption for another persons approved oTAP and exercise their option:
Add checks within Magnetar that the user owns the NFT on which theyre making a call.
Access Control
0xWeiss (Tapioca) confirmed
