0brxce - requireProposerOrAcceptor name differs from implementation

[sherlock-admin3]

0brxce

High

requireProposerOrAcceptor name differs from implementation

Summary

In the Admin Proxy contract, the requireProposerOrAcceptor modifier expects the caller to have the proposer role or acceptor role but the code implementation requires them to have both

Vulnerability Detail

The following functions have the requireProposerOrAcceptor modifier: proposeBaseImplementation, propose. If a caller doesn't have both roles the function call will fail.

Impact

The admin proxy will be unable to propose new base implementations or create new proposals

Code Snippet

requireProposerOrAcceptor Modifier
https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/security/AdminProxy.sol#L42-L46

Modifier in use for proposeBaseImplementation and propose
https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/security/AdminProxy.sol#L103-L113
https://github.com/sherlock-audit/2024-06-mellow/blob/main/mellow-lrt/src/security/AdminProxy.sol#L116-L125

Tool used

Manual Review

Recommendation

Use || instead of && in the conditional line for the requireProposerOrAcceptor modifier
Change the name to requireProposerAndModifier