PoolTogether - John's results

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L394-L415

Vulnerability details

Impact

The function mintYieldFee in Vault.sol does not have any access restrictions.

Consequently, anyone has the capability to mint Vault shares and allocate them to any recipient without limitations or restrictions.

Proof of Concept

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L394-L415

function mintYieldFee(uint256 _shares, address _recipient) external {
    _requireVaultCollateralized();
    if (_shares > _yieldFeeTotalSupply) revert YieldFeeGTAvailable(_shares, _yieldFeeTotalSupply);

    _yieldFeeTotalSupply -= _shares;
    _mint(_recipient, _shares);

    emit MintYieldFee(msg.sender, _recipient, _shares);
}

The function mintYieldFee in Vault.sol serves the purpose of minting Vault shares and allocating them to the yield fee recipient specified by _recipient.

However, it lacks a modifier to restrict access to this function.

As a result, anyone can call this function and mint Vault shares for any recipient of their choice without any limitations or restrictions.

Indeed, the absence of access restrictions and proper validation in the mintYieldFee function of Vault.sol can lead to the loss of the intended yield fee.

As anyone can call this function and mint Vault shares for any recipient, it can result in unauthorized or unintended allocation of the yield fee, potentially leading to financial losses or incorrect distribution of funds.

Tools Used

Recommended Mitigation Steps

It is crucial to add a modifier that restricts the access to the mintYieldFee function in order to ensure proper control and prevent unauthorized usage.

By implementing a suitable modifier, such as onlyOwner or onlyAdmin, you can restrict the function's execution to only authorized individuals or entities.

This helps maintain the integrity of the yield fee allocation process and reduces the risk of unintended or unauthorized minting of Vault shares.

Assessed type

Access Control