Unrestricted ComptrollerInterface and InterestRateModel Contract Changes by Admin and PendingAdmin leading to Loss of Funds for Users

Lines of code Vulnerability details Impact // Maximum borrow rate that can ever be applied .0005% / block uint internal constant borrowRateMaxMantissa = 0.0005e16; // Maximum fraction of interest that can be set aside for reserves uint internal constant reserveFactorMaxMantissa = 1e18; The...

Unrestricted ComptrollerInterface and InterestRateModel Contract Changes by Admin and "PendingAdmin" leading to Loss of Funds for Users

Lines of code Vulnerability details Impact / @notice Contract which oversees inter-cToken operations / ComptrollerInterface public comptroller; / @notice Model which tells what the current interest rate should be / InterestRateModel public interestRateModel; / @notice Administrator for this...

Transferring admins does not work for CToken

Lines of code Vulnerability details Impact The CToken implements an acceptAdmin function that sets the new admin to the pendingAdmin. But CToken does not implement a setPendingAdmin function to set the pendingAdmin in the first place. Therefore, the acceptAdmin function is useless and CTokens can...