Lines of code
<https://github.com/prepo-io/prepo-monorepo/blob/feat/2022-12-prepo/packages/prepo-shared-contracts/contracts/AllowedMsgSenders.sol#L15-L18&gt;
<https://github.com/prepo-io/prepo-monorepo/blob/feat/2022-12-prepo/packages/prepo-shared-contracts/contracts/TokenSenderCaller.sol#L11-L14&gt;
<https://github.com/prepo-io/prepo-monorepo/blob/feat/2022-12-prepo/packages/prepo-shared-contracts/contracts/TokenSenderCaller.sol#L20-L23&gt;

Vulnerability details

Impact

The value can be set by everyone

Proof of Concept

All these functions can be overridden by the child contracts. If all these functions are called from the child contracts, there are modifiers restricting everyone to call the functions. However, all these functions can be called directly (Not from any child contract) and everyone can alter the value which is dangerous.

Tools Used

Manual

Recommended Mitigation Steps

Adopt the same access modifiers as those in the child contracts.

The text was updated successfully, but these errors were encountered:

All reactions