Locking logic in Rebalancers can be changed to avoid SSTOREs.

[code423n4]

Handle

p4st13r4

Vulnerability details

Impact

If a rebalance is done in more than one transaction, locking the basket at each transaction can be avoided.

Proof of Concept

Tools Used

Editor

Recommended Mitigation Steps

(a) Implement lock() method in RebalanceManager.sol, RebalanceManagerV2.sol, RebalanceManagerV3.sol as:

    function lock() external onlyRebalanceManager {
        basket.singleCall(
            address(basket),
            abi.encodeWithSelector(basket.setLock.selector, _block),
            0
        );
    }

Effectively making lockBasketData not needed.RebalanceManager.sol, RebalanceManagerV2.sol will need a new constructor argument uint256 _lockTime and a new state variable uint256 public lockTime.

(b) In RebalanceManager.sol, RebalanceManagerV2.sol, RebalanceManagerV3.sol remove the line lockBasketData(block.number + 30) at the beginning of rebalance method.

(c) On rebalance method first line in RebalanceManager.sol, RebalanceManagerV2.sol add require(basket.getLock(), "REQUIRE_LOCK") (as in contracts/basket/contracts/callManagers/RebalanceManagerV3.sol)

When performing a rebalance:

(d) Call RebalanceManager.lock().

(e) Perform the rebalance using the rebalance() method.