Anyone can call memorializePositions in PositionManager

[code423n4]

Lines of code

https://github.com/code-423n4/2023-05-ajna/blob/main/ajna-core/src/PositionManager.sol#L170-L172

Vulnerability details

Impact

In the PositionManager contract user can call the memorializePositions function to transfer his LP to the position manager, this will save his LP information and bind it to the NFT. To do this he first needs to mint an NFT for the pool of his choice and then approve a position manager to hold his LP. Ajna doesn't restrict access to the memorializePositions so anyone can call it and transfer LP to the position manager without the knowledge of the NFT owner.

Proof of Concept

Let's say Alice minted a token and approved PositionManager to use her LP, but she doesn't have intention to memorize her position right now. This opens up the possibility for the griefer account to call memorializePositions on it, causing Alice's liquidity to be transferred to the position manager at the wrong time.

Tools Used

Manual review

Recommended Mitigation Steps

Add _isApprovedOrOwner(msg.sender, tokenId_) check in memorializePositions

Assessed type

Access Control

[c4-judge]

Picodes marked the issue as duplicate of #488

[Picodes]

The impact described does not qualify for High Severity - the loss of funds scenario without external requirements is not obvious.

[c4-judge]

Picodes marked the issue as partial-50

[c4-judge]

Picodes changed the severity to 3 (High Risk)