Abracadabra Mimswap - ravikiranweb3's results

Lines of code

https://github.com/code-423n4/2024-03-abracadabra-money/blob/1f4693fdbf33e9ad28132643e2d6f7635834c6c6/src/staking/LockingMultiRewards.sol#L324-L332

Vulnerability details

Impact

recover() enables the owner to withdraw the token balance in the contract to any address of their discretion.

This opens a possibility of vulnerability where the owner can withdraw the token balance deposited in the contract. This is completely at the discretion of the owner to exercise this power and do a rug pull.

Proof of Concept

function recover(address tokenAddress, uint256 tokenAmount) external onlyOwner {
        // In case it's the staking token, allow to skim the excess
        if (tokenAddress == stakingToken && tokenAmount > stakingToken.balanceOf(address(this)) - stakingTokenBalance) {
            revert ErrSkimmingTooMuch();
        }

        tokenAddress.safeTransfer(owner, tokenAmount);
        emit LogRecovered(tokenAddress, tokenAmount);
    }

Tools Used

Manual Review

Recommended Mitigation Steps

If the purpose of this function is to skim the excess, dont take the token amount as parameter, instead implement a logic to compute the excess and allow skim and withdraw only the excess amount.

Assessed type

Rug-Pull