Arbitrary call with user-controlled target
Dolomite's assessment for RD-F-013 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
DolomiteMargin's callFunction mechanism allows external calls through AutoTrader contracts — a core design feature requiring operator whitelist authorization (ownerSetAutoTraderSpecial, ownerSetGlobalOperator in AdminImpl.sol). Current v2 requires global operator whitelist for liquidators/expirations. Not a fully user-controlled unfiltered call, but the mechanism does perform external calls to whitelisted contracts with user-supplied parameters. Yellow: filtered by admin-controlled allowlist.
Sources #
- GitHubDolomiteMargin READMEREADME: liquidations/expirations require authorization from designated global operators (operator whitelist)retrieved 2026-05-16
- DolomiteMargin AdminImpl.solAdminImpl.sol: ownerSetAutoTraderSpecial and ownerSetGlobalOperator — operator whitelist for external callsretrieved 2026-05-16
Methodology #
Determine whether any contract performs `.call(target, data)` where target and/or data is user-supplied without a target allowlist or selector filter.
See the full factor methodology and distribution across all protocols →