Platform: Code4rena
Start Date: 03/05/2022
Pot Size: $75,000 USDC
Total HM: 6
Participants: 55
Period: 7 days
Judge: Albert Chon
Total Solo HM: 2
Id: 116
League: COSMOS
Rank: 21/55
Findings: 1
Award: $502.47
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: p_crypt0
Also found by: 0x1337, GermanKuber, IllIllI, WatchPug, csanuragjain, danb, dirk_y, kirk-baird
https://github.com/code-423n4/2022-05-cudos/blob/main/solidity/contracts/Gravity.sol#L632
The reward tokens are not meant for Admins, but using withdrawERC20 function Admin can withdraw all reward tokens
Observe the withdrawERC20 function
Admin is allowed to withdraw any token including _newValset.rewardToken at Gravity.sol#L344.
Ideally Admin should not be allowed to withdraw _newValset.rewardToken
Add a check in withdrawERC20 to fail the function if Admin tries to withdraw reward token
#0 - mlukanova
2022-05-10T14:31:49Z
Duplicate of #14