Skip to content

Latest commit

 

History

History
46 lines (27 loc) · 1.77 KB

041.md

File metadata and controls

46 lines (27 loc) · 1.77 KB
Raw

Sparkly Fleece Mammoth

Medium

Name Of _exchangeName In MorphoLeverageStrategyExtension.sol Is Not Unique

Summary

In function engage(string memory _exchangeName) external onlyOperator { _enterCollateralPosition(); https://github.com/sherlock-audit/2024-10-morpho-x-index/blob/main/index-coop-smart-contracts/contracts/adapters/MorphoLeverageStrategyExtension.sol#L274C4-L275C36

_exchangeName is not unique and errors can be made if a name is duplicated for two different leverage positions

Root Cause

  • The choice to not require the _exchangeName parameter to be unique will lead to the contract not having a way to differentiate between them, if a name is mistakenly passed twice by the operator
  • emitting of an event having multiple positions with the same name would lead to difficulties in tracking events on-chain

Internal pre-conditions

  1. operator opens a leverage position with eth/usdc at position A
  2. operator does not keep track of the name and opens another leverage position on eth/usdc at another on position B

External pre-conditions

No response

Attack Path

No response

Impact

  1. When the function is called, it not know which position to reference. leading to errors inliquidation, rebalancing, or withdrawing assets
  2. Incorrect emit of events would make monitoring and debugging difficult as it would be hard to distinguish between events related to different leverage positions
  3. Users might inadvertently engage with the wrong position or have difficulty understanding their current holdings and liabilities.

PoC

No response

Mitigation

  1. require statement to ensure _exchangeName is unique
  2. unique names can be enforced by mapping of active leverage positions against a new position to be created