L-06·
Role assignment mismatch in `PoolAdminFacet` initialization
TL;DR
Link: https://github.com/Hyperhyperfi/protocol/blob/212acfdcd4066334ff5ea06ce46b0bbca7ca212f/src/core/pool/facets/PoolAdminFacet.sol#L43-L53
Severity
LOW
Method
MManual review
CAT.
There exists a critical issue in the initialization process of PoolAdminFacet where the initialization can fail due to a mismatch between role assignment and access control.
The problem occurs in the following sequence:
solidity
function init(address owner, AddToken[] calldata assets, PoolStorage.BaseSetUp memory baseSetUp)externalinitializer{_grantRole(AccessControlStorage.DEFAULT_ADMIN_ROLE, owner);baseSetUp = _applyDefaultValues(baseSetUp);PoolStorage.layout().setUp.base = baseSetUp;addTokens(assets); // This call will fail if owner != msg.sender}function addTokens(AddToken[] calldata newAssets) public onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {// ... implementation}
The issue arises because:
- The init function assigns the
DEFAULT_ADMIN_ROLEto the specifiedowneraddress. - Immediately after, it calls
addTokenswhich has theonlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE)modifier. - When
owner != msg.sender, the initialization process fail becausemsg.senderdoesn't have the required role whenaddTokensis called.
To mitigate this issue, modify the role assignment, and assign the DEFAULT_ADMIN_ROLE directly to msg.sender.
02Section · Report provenance
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.