Skip to content

Latest commit

 

History

History
43 lines (23 loc) · 1.22 KB

File metadata and controls

43 lines (23 loc) · 1.22 KB

Ripe Sage Ant

Medium

User can vouch on archived subject contrary to documentation

Summary

The missing check in increaseVouch() allows to vouch on archived subjectId.

Root Cause

In increaseVouch() there is missing check that subjectProfileId is not archived.

As a result user can vouch for archived subject contrary to documentation

Internal pre-conditions

Author must submit vouch when subject is not archived. And only then he is available to increase balance.

External pre-conditions

No response

Attack Path

  1. User calls vouchByProfileId() with minimum amount
  2. Subject is archived
  3. User calls increaseVouch(), increasing his stake on archived subject

Impact

Documentation is violated. Description in the file beginning serves as documentation.

User can increase stake balance on archived subject. It is hard to point out exact impact because system is not fully implemented yet.

PoC

No response

Mitigation

Add missing check.