M-06 MitigationConfirmed

[code423n4]

Lines of code

Vulnerability details

Original Issue

M-06 - drawManager CAN BE SET TO A MALICIOUS ADDRESS

Details

In the previous implementation, there was no access control for the PrizePool.setDrawManager. If the drawManager was not initialized in the constructor, anybody was allowed to set the drawManager to an address of their own

Mitigation

The new logic correctly solves the access control issue, now, in the constructor is initialized a deployer which is set to be the caller (the one creating the PrizePool contract), and in the PrizePool.setDrawManager() was added a check to validate that only the deployer was allowed to set the DrawManager.

function setDrawManager(address _drawManager) external {
  if (msg.sender != deployer) {
    revert NotDeployer();
  }
  if (drawManager != address(0)) {
    revert DrawManagerAlreadySet();
  }
  drawManager = _drawManager;

  emit DrawManagerSet(_drawManager);
}

Conclusion

The implemented mitigation solves the original issue.

[c4-judge]

Picodes marked the issue as satisfactory