highLogic errorEVM-Solidity
NOYA: `Registry.sol#updateHoldingPosition` remove position logic is incorrect: should use `ownerConnector` instead of `calculatorConnector` when calculating `holdingPositionId`
- Payout
- $0
- Protocol
- NOYA
- Disclosed
- Feb 17, 2025
- Source
- code4rena
NOYA's Registry implements token-position removal with a swap-and-pop pattern: when a position that is not the tail of the array is removed, the last element is copied into its slot and the tail is popped. The bug is that updateHoldingPosition recomputes the s …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-04-noya-findings/issues/1093
- https://github.com/code-423n4/2024-04-noya-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.