Ethereum Credit Guild - Takarez's results

Lines of code

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L259

Vulnerability details

Summary

The getRewards() function here https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L259 allows users to claim reward, but a call has been made to the mint function at https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/rate-limits/RateLimitedMinter.sol#L49 which has whenNotPaused modifier . This will denied user from getting rewards. This opens up an attack vector, where the protocol owner can decide if the users are able to withdraw/claim any funds from it.

This is a common centralization problem which means the contract owner can "rug" users.

Proof of Concept

https://github.com/code-423n4/2023-12-ethereumcreditguild/blob/2376d9af792584e3d15ec9c32578daa33bb56b43/src/loan/SurplusGuildMinter.sol#L259

Tools Used

manual code review

Impact

user funds can be left stuck in the contract funds can stay forever if a Governor or Guardian renounce ownership or compromised (The multiSig) will leave the funds there forever

Recommended Mitigation Steps

Remove the whenNotPaused modifier from mint function or implement a way where user can claim reward without minting them(pre-mint), so users can claim vested tokens even if admin pauses the contract.

Assessed type

Access Control