transferAllowed() function can be called by anyone

Handle jayjonah8 Vulnerability details Impact In ControllerV1.sol the transferAllowed function can be called by anyone and supplied with arbitrary values to manipulate the protocol as if it was the LPool address. This function should only be callable by the LPool as can be seen in the mintAllowed...

Unsafe Cast

Handle mics Vulnerability details use openzeppilin's safeCast in: ControllerV1.sol, L190: unsafe cast from uint256 to uint64 of the variable blockTime ControllerV1.sol, L192: unsafe cast from uint256 to uint64 of the variable blockTime --- The text was updated successfully, but these errors were...