Zellic - Audit Reports

Outdated comments

The upgradeWNatContract function now requires governance or the governance executor to invoke it, yet the in-line comments in both AgentCollateralFacet and IIAssetManager still state that only the agent vault owner may call it:

/**
 * When current pool collateral token contract (WNat) is replaced by the method setPoolWNatCollateralType,
 * pools don't switch automatically. Instead, the agent must call this method that swaps old WNat tokens for
 * new ones and sets it for use by the pool.
 * NOTE: may only be called by the agent vault owner.
 */
function upgradeWNatContract(
    uint256 _start,
    uint256 _end
)
    external
    onlyImmediateGovernanceOrExecutor
{
    // [...]
}


/**
 * When current pool collateral token contract (WNat) is replaced by the method setPoolWNatCollateralType,
 * pools don't switch automatically. Instead, the agent must call this method that swaps old WNat tokens for
 * new ones and sets it for use by the pool.
 * NOTE: may only be called by the agent vault owner.
 */
function upgradeWNatContract(
    uint256 _start,
    uint256 _end
) external;

We recommend updating the comments to reflect the access-control requirements.