Spheron V2

The above function should only be called by owner but it lacks modifier onlyOwner so anyone can initiate claiming of penaltyAssets, although the assets are being transferred to the owner so this is a low issue. And emit PenaltyAssetsDistributed(msg.sender, penaltyAssets); event is emitted with msg.sender which is wrong if anyone else apart from the owner calls this function.<br><code>solidity function claimPenaltyAssets() external { require(penaltyShares > 0, "No penalty shares"); uint256 penaltyAssets = pToken.convertToAssets(penaltyShares); penaltyShares = 0; pToken.transfer(owner(), penaltyAssets); emit PenaltyAssetsDistributed(msg.sender, penaltyAssets); } </code>

<code>solidity function updateCollateralConfig(CollateralConfig memory _collateralConfig) external onlyOwner { _updateCollateralConfig(_collateralConfig); } function _updateCollateralConfig(CollateralConfig memory _collateralConfig) internal { if (!CoreLogic.validateCollateralConfig(_collateralConfig, PARAM_PRECISION)) revert InvalidCol lateralConfig(); slashingBuffer = _collateralConfig.slashingBuffer; isSlashingBufferAbsoluteValue = _collateralConfig.isSlashingBufferAbsoluteValue; liquidationThreshold = _collateralConfig.liquidationThreshold; collateralFactor = _collateralConfig.collateralFactor; emit CollateralConfigUpdated(_collateralConfig); } </code><br>The above function. is called by owner to update the collateral config, It updates certain important states including liquidationThreshold , the problem is when liquidationThreshold is updated it can trigger sudden liquidation for healthy positions too If we take a look at coreLogic.startLiquidation() it has a check and when liquidationThreshold is changed the check can be bypassed suddenly and healthy positions can become unhealthy and become prone to sudden liquidation.<br><code>solidity if (fullRepayTokenAmount < (collateralValue * liquidationThreshold) / paramPrecision) { revert CannotLiquidateHealthyAgent(); } </code>

IWETH constant weth = IWETH(0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2); // need to manually update for each chain//@audit [L] hardcoded address for weth, WETH has diff address on diff chains