PoolTogether - mahdirostami's results

A protocol for no-loss prize savings

General Information

Platform: Code4rena

Start Date: 07/07/2023

Pot Size: $121,650 USDC

Total HM: 36

Participants: 111

Period: 7 days

Judge: Picodes

Total Solo HM: 13

Id: 258

League: ETH

PoolTogether

Findings Distribution

Researcher Performance

Rank: 106/111

Findings: 1

Award: $2.25

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

2.2492 USDC - $2.25

Labels

bug
3 (High Risk)
satisfactory
duplicate-396

External Links

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L394-L402

Vulnerability details

Impact

all _yieldFeeTotalSupply from vault

Proof of Concept

In

  function mintYieldFee(uint256 _shares, address _recipient) external {
    _requireVaultCollateralized();
    if (_shares > _yieldFeeTotalSupply) revert YieldFeeGTAvailable(_shares, _yieldFeeTotalSupply);


    _yieldFeeTotalSupply -= _shares;
    _mint(_recipient, _shares);


    emit MintYieldFee(msg.sender, _recipient, _shares);
  }

anyone call this function and get all _yieldFeeTotalSupply

Tools Used

manual

remove address _recipient and mint for _yieldFeeRecipient

-  function mintYieldFee(uint256 _shares, address _recipient) external {
+  function mintYieldFee(uint256 _shares) external { //@audit high anyone can call use _yieldFeeRecipient for recipent instead
     _requireVaultCollateralized();
     if (_shares > _yieldFeeTotalSupply) revert YieldFeeGTAvailable(_shares, _yieldFeeTotalSupply);
 
     _yieldFeeTotalSupply -= _shares;
-    _mint(_recipient, _shares);
+    _mint(_yieldFeeRecipient, _shares);

Assessed type

Access Control

#0 - c4-judge

2023-07-14T22:23:56Z

Picodes marked the issue as duplicate of #396

#1 - c4-judge

2023-08-05T22:03:38Z

Picodes marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter