M-01 MitigationConfirmed

[c4-bot-2]

Lines of code

Vulnerability details

Original issue

Governance can adjust the DAO fee by adding or removing the RSR token as a distribution target.

Mitigation

The issue is properly addressed by preventing both RSR and RToken from being set as distribution targets.

function _setDistribution(address dest, RevenueShare memory share) internal {
    require(dest != address(0), "dest cannot be zero");
    require(
        dest != address(furnace) && dest != address(stRSR),
        "destination cannot be furnace or strsr directly"
    );
    require(
        dest != address(rsr) && dest != address(rToken),  // @audit, here
        "destination cannot be rsr or rToken"
    );
}

[c4-judge]

thereksfour marked the issue as satisfactory