# Anyone can set the baseRatePerYear after the updateFrequency has passed

Public updateBaseRate() in Canto NoteInterest lacks access control, letting anyone reset baseRatePerYear every 24h and manipulate borrow/supply rates.

- Payout: Audit contest
- Severity: high
- Program: Canto
- Found by: 0xDjango
- Disclosed: 2022-10-18
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-06-newblockchain-findings/issues/22
- Library page: https://bugbountylibrary.com/r/c4%3A2022-06-canto%3AH-01
- Tags: area:web3 domain:web3 impact:integrity kind:contest platform:code4rena sev:high tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** NoteInterest.sol interest rate model contract
**Root cause:** updateBaseRate() is public with no access control; it only checks deltaBlocks > updateFrequency before overwriting baseRatePerYear.
**Steps:**
1. Wait until block.number - lastUpdateBlock > updateFrequency (default 24h).
2. Call `updateBaseRate(newBaseRatePerYear)` from any address.
3. baseRatePerYear is overwritten and lastUpdateBlock reset, altering borrow/supply rates protocol-wide.
**How found:** Code review of NoteInterest.sol interest-rate functions spotted updateBaseRate() declared public with only a time-delta check and no access modifier, unlike admin-only _setBaseRatePerYear().
**Exploitation:** Any user calls the public updateBaseRate() after the 24h window to set an arbitrary baseRatePerYear, skewing interest rates and potentially bricking integrating contracts or enabling economic exploits; admin fix via _setBaseRatePerYear does not reset lastUpdateBlock so the window reopens.
**Insight:** When auditing rate/oracle setters, compare public functions against admin-only equivalents; a missing access modifier plus a time-gate check is a common oversight that lets anyone rewrite critical parameters.