Critical changes executed bu privileged roles should have safeguards

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L440
https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemicTokenV2.sol#L92
https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemicTokenV2Base.sol#L98
https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L407
https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L416
https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L433
https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L492

Vulnerability details

Impact

Admin can change the protocol fee, flash minting fee, liquididation limit and other similar important parameters anytime to any value. Such changes may effect user decisions, hence they should have some safeguards such as timelocks and/or limits.
Even if there is no bad intention, this kind of excessive power issueance to the admin can potentially be used to damage the reputation of the protocol.

Proof of Concept

code-423n4/2021-09-swivel-findings#101

Tools Used

Manual analysis

Recommended Mitigation Steps

• A timelock can be added for such critical changes which may effect user decisions.
• Max limits can be defined for fees, limits, etc, which updates are checked against and higher than max values are not allowed.

[0xfoobar]

Sponsor acknowledged

Assume honest admin

[0xleastwood]

Considering the admin is held behind a timelock contract + multisig, I'm inclined to downgrade this to QA.

Duplicate of #142.