Changes in underlying token mid-operation may cause issues
The setUnderlyingToken function in the AdminStrategy.sol contract allows the underlying token to be changed at any time by any user with the appropriate role.
The setUnderlyingToken function in the AdminStrategy.sol contract allows the underlying token to be changed at any time by any user with the appropriate role.
function setUnderlyingToken(address underlyingToken_) external onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {StrategyStorage.layout().setUp.base.underlyingToken = underlyingToken_;}
This presents a certain risk, particularly if the underlyingToken is modified while operations dependent on it are in progress. For instance, if a strategy is executing trades or managing positions based on the current underlyingToken, changing the token midway can lead to inconsistent states and unexpected behavior.
To mitigate this issue, don't allow setUnderlyingToken after the strategy has been connected.
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.