Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-04·

Changes in underlying token mid-operation may cause issues

Not reportedoptionsleverageblack-scholes
TL;DR

The setUnderlyingToken function in the AdminStrategy.sol contract allows the underlying token to be changed at any time by any user with the appropriate role.

Severity
LOW
Method
MManual review
CAT.

The setUnderlyingToken function in the AdminStrategy.sol contract allows the underlying token to be changed at any time by any user with the appropriate role.

solidity
function setUnderlyingToken(address underlyingToken_) external onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {
StrategyStorage.layout().setUp.base.underlyingToken = underlyingToken_;
}

This presents a certain risk, particularly if the underlyingToken is modified while operations dependent on it are in progress. For instance, if a strategy is executing trades or managing positions based on the current underlyingToken, changing the token midway can lead to inconsistent states and unexpected behavior.

To mitigate this issue, don't allow setUnderlyingToken after the strategy has been connected.

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-04