sherlock-audit/2023-05-Index-judging

erictee - M - wrong modifier used in transferTokens function in BaseManagerv2.sol according to the comment.

Closed this issue · 0 comments

sherlock-admin commented

erictee

medium

M - wrong modifier used in transferTokens function in BaseManagerv2.sol according to the comment.

Summary

wrong modifier detected according to the comment.

Vulnerability Detail

Wrong modifier is used in BaseManagerV2.sol#L310-L318 as it is stated in the comment that this function is OPERATOR ONLY however the onlyExtension() modifier is used instead.

Impact

The function transferTokens cannot be called by operators and can be called by extensions unexpectedly.

Code Snippet

https://github.com/sherlock-audit/2023-05-Index/blob/main/index-coop-smart-contracts/contracts/manager/BaseManagerV2.sol#L310-L318

Tool used

Manual Review

Recommendation

Change the modifier onlyExtension to onlyOperator to match the comment.

Duplicate of #337