registerAsset() can overwrite _assetClass value

[code423n4]

Handle

gpersoon

Vulnerability details

Impact

Everyone can call the function registerAsset() of MochiProfileV0.sol
Assuming the liquidity for the asset is sufficient, registerAsset() will reset the _assetClass of an already registered asset to AssetClass.Sigma.

When the _assetClass is changed to AssetClass.Sigma then liquidationFactor(), riskFactor(), maxCollateralFactor(), liquidationFee() keeperFee() maxFee() will also return a different value.
Then the entire vault will behave differently.
The threshold for liquidation will also be different, possibly leading to a liquidation that isn't supposed to happen.

Proof of Concept

https://github.com/code-423n4/2021-10-mochi/blob/806ebf2a364c01ff54d546b07d1bdb0e928f42c6/projects/mochi-core/contracts/profile/MochiProfileV0.sol#L58-L62

https://github.com/code-423n4/2021-10-mochi/blob/806ebf2a364c01ff54d546b07d1bdb0e928f42c6/projects/mochi-core/contracts/profile/MochiProfileV0.sol#L105-L128

https://github.com/code-423n4/2021-10-mochi/blob/806ebf2a364c01ff54d546b07d1bdb0e928f42c6/projects/mochi-core/contracts/profile/MochiProfileV0.sol#L129-L146

https://github.com/code-423n4/2021-10-mochi/blob/806ebf2a364c01ff54d546b07d1bdb0e928f42c6/projects/mochi-core/contracts/profile/MochiProfileV0.sol#L148-L170

https://github.com/code-423n4/2021-10-mochi/blob/806ebf2a364c01ff54d546b07d1bdb0e928f42c6/projects/mochi-core/contracts/profile/MochiProfileV0.sol#L176-L198

https://github.com/code-423n4/2021-10-mochi/blob/806ebf2a364c01ff54d546b07d1bdb0e928f42c6/projects/mochi-core/contracts/profile/MochiProfileV0.sol#L200-L222

https://github.com/code-423n4/2021-10-mochi/blob/806ebf2a364c01ff54d546b07d1bdb0e928f42c6/projects/mochi-core/contracts/profile/MochiProfileV0.sol#L224-L240

Tools Used

Recommended Mitigation Steps

Add the following in function registerAsset():
require(_assetClass[_asset] ==0,"Already exists");