Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-06·

Role assignment mismatch in `PoolAdminFacet` initialization

Not reportedoptionsleverageblack-scholes
TL;DR

Link: https://github.com/Hyperhyperfi/protocol/blob/212acfdcd4066334ff5ea06ce46b0bbca7ca212f/src/core/pool/facets/PoolAdminFacet.sol#L43-L53

Severity
LOW
Method
MManual review
CAT.

Link: https://github.com/Hyperhyperfi/protocol/blob/212acfdcd4066334ff5ea06ce46b0bbca7ca212f/src/core/pool/facets/PoolAdminFacet.sol#L43-L53

There exists a critical issue in the initialization process of PoolAdminFacet where the initialization can fail due to a mismatch between role assignment and access control.

The problem occurs in the following sequence:

solidity
function init(address owner, AddToken[] calldata assets, PoolStorage.BaseSetUp memory baseSetUp)
external
initializer
{
_grantRole(AccessControlStorage.DEFAULT_ADMIN_ROLE, owner);
baseSetUp = _applyDefaultValues(baseSetUp);
PoolStorage.layout().setUp.base = baseSetUp;
addTokens(assets); // This call will fail if owner != msg.sender
}
function addTokens(AddToken[] calldata newAssets) public onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {
// ... implementation
}

The issue arises because:

  • The init function assigns the DEFAULT_ADMIN_ROLE to the specified owner address.
  • Immediately after, it calls addTokens which has the onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) modifier.
  • When owner != msg.sender, the initialization process fail because msg.sender doesn't have the required role when addTokens is called.

To mitigate this issue, modify the role assignment, and assign the DEFAULT_ADMIN_ROLE directly to msg.sender.

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-06