# registerAsset() can overwrite _assetClass value

Anyone can call registerAsset() to reset an existing asset's _assetClass to Sigma, altering risk/liquidation factors and vault behavior.

- Payout: Audit contest
- Severity: high
- Program: Mochi
- Found by: gpersoon
- Disclosed: 2021-11-23
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2021-10-mochi-findings/issues/20
- Library page: https://bugbountylibrary.com/r/c4%3A2021-10-mochi%3AH-04
- Tags: area:web3 domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** MochiProfileV0.sol registerAsset()
**Root cause:** registerAsset() lacks a check that the asset is not already registered, so it overwrites _assetClass for existing assets.
**Steps:**
1. Call `registerAsset()` on MochiProfileV0.sol for an already-registered asset with sufficient liquidity
2. Function resets `_assetClass[_asset]` to `AssetClass.Sigma`
3. liquidationFactor(), riskFactor(), maxCollateralFactor(), liquidationFee(), keeperFee(), maxFee() now return Sigma-class values
**How found:** Code review of registerAsset() noticing no guard against re-registering an existing asset, then tracing downstream parameter functions keyed on _assetClass.
**Exploitation:** Attacker calls registerAsset() on an existing asset to force its class to Sigma, changing risk and liquidation parameters across the vault; may trigger unintended liquidations.
**Insight:** Registration/initialization functions that write config keyed by an ID should be checked for missing 'already exists' guards; parameter getters keyed on that config become attacker-controllable.