Incorrect implementation of updateEmergencyCouncil

[howlbot-integration]

Lines of code

https://github.com/code-423n4/2024-08-superposition/blob/4528c9d2dbe1550d2660dac903a8246076044905/pkg/seawater/src/lib.rs#L1109-L1124

Vulnerability details

Impact

The emergency_council address can never be updated once set

Vulnerability Details

It appears that this issue is caused by a copy-paste error. The developer seems to have copied the code from the update_nft_manager_9_B_D_F_41_F_6 function and used it as the basis for the update_emergency_council_7_D_0_C_1_C_58 function. However, they forgot to change the variable name from nft_manager to emergency_council. As a result, the function does not work as intended. Instead of setting the address for emergency_council, the function mistakenly sets it for nft_manager.

This oversight introduces a significant security risk because the nft_manager has the authority to change the owner of any user's position, which is a higher level of authority compared to the emergency_council, which can only disable the pool. Therefore, this bug not only renders the intended function inoperative but also poses a potential security vulnerability.

Tools Used

Manual analysis

Recommended Mitigation Steps

Replace the nft_manager on L1121 with emergency_council

Assessed type

Access Control

[c4-judge]

alex-ppg changed the severity to 3 (High Risk)

[c4-judge]

alex-ppg marked the issue as satisfactory