Risk corruption from uncontrolled id in `setPositionsManager`
The AdminOperationalTreasury.setPositionsManager() function allows the protocol admin to replace the active PositionsManager contract.
The AdminOperationalTreasury.setPositionsManager() function allows the protocol admin to replace the active PositionsManager contract. However, it does not enforce any validation on the new manager’s position ID counter (nextTokenId()).
Position IDs are used as shared keys across multiple components, including position storage, strategy tracking, and payout logic. If a new PositionsManager is registered and begins minting IDs that collide with existing ones, it will overwrite or corrupt the existing position state, leading to data inconsistencies or even fund loss.
Consider adding a check when assigning a new position manager to ensure ID sequence continuity.
function setPositionsManager(address manager_) external onlyRole(AccessControlStorage.DEFAULT_ADMIN_ROLE) {- OperationalTreasuryStorage.layout().setUp.base.manager = IPositionsManager(manager_);+ uint256 currentNextId = OperationalTreasuryStorage.layout().setUp.base.manager.nextTokenId();+ if (currentNextId < IPositionsManager(manager_).nextTokenId()) revert InvalidPositionManager();OperationalTreasuryStorage.layout().setUp.base.manager = IPositionsManager(manager_);}
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.