PoolTogether micro contest #1 - jonah1005's results

A protocol for no loss prize savings on Ethereum

General Information

Platform: Code4rena

Start Date: 29/07/2021

Pot Size: $20,000 USDC

Total HM: 8

Participants: 12

Period: 3 days

Judge: LSDan

Total Solo HM: 2

Id: 24

League: ETH

PoolTogether

Findings Distribution

Researcher Performance

Rank: 9/12

Findings: 2

Award: $565.86

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository PoolTogether

Findings Information

🌟 Selected for report: cmichel

Also found by: hickuphh3, jonah1005, pauliax

Labels

bug

duplicate

2 (Med Risk)

SwappableYieldSource

Awards

565.8571 USDC - $565.86

External Links

Link to GitHub issue

Handle

jonah1005

Vulnerability details

Impact

In function redeemToken, it uses transferFrom instead of transfer. It might stop users from redeeming tokens.

Proof of Concept

https://github.com/pooltogether/swappable-yield-source/blob/89cf66a3e3f8df24a082e1cd0a0e80d08953049c/contracts/SwappableYieldSource.sol#L240

Tools Used

None

Recommended Mitigation Steps

Use safeTransfer instead.

#0 - PierrickGT
2021-08-06T16:16:39Z

Duplicate of https://github.com/code-423n4/2021-07-pooltogether-findings/issues/25

PoolTogether micro contest #1 - jonah1005's results

A protocol for no loss prize savings on Ethereum

General Information

Findings Distribution

Researcher Performance

External Links

[H-02] ambiguous transferFrom - $565.86

Findings Information

Labels

Awards

External Links

Handle

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

#0 - PierrickGT2021-08-06T16:16:39Z

#0 - PierrickGT
2021-08-06T16:16:39Z