PoolTogether - teawaterwire's results

A protocol for no-loss prize savings

General Information

Platform: Code4rena

Start Date: 07/07/2023

Pot Size: $121,650 USDC

Total HM: 36

Participants: 111

Period: 7 days

Judge: Picodes

Total Solo HM: 13

Id: 258

League: ETH

PoolTogether

Findings Distribution

Researcher Performance

Rank: 104/111

Findings: 1

Award: $2.25

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

2.2492 USDC - $2.25

Labels

bug
3 (High Risk)
satisfactory
upgraded by judge
duplicate-396

External Links

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L394

Vulnerability details

Impact

Anyone can come and claim the yield fee for themselves.

Proof of Concept

In testLiquidateAndMintFees in Liquidate.t.sol just change this line:

vault.setYieldFeeRecipient(bob);

to a random address

vault.setYieldFeeRecipient(0xc0ffee);

and keeping that line:

vault.mintYieldFee(_yieldFeeShares, bob);

by running forge test --match-test testLiquidateAndMintFees it returns no errors.

Fee shares are minting to bob even though is not the fee recipient.

Tools Used

foundry

Send fees to the right recipient

Assessed type

Access Control

#0 - c4-judge

2023-07-18T15:32:12Z

Picodes marked the issue as duplicate of #396

#1 - c4-judge

2023-08-05T22:03:51Z

Picodes changed the severity to 3 (High Risk)

#2 - c4-judge

2023-08-05T22:04:35Z

Picodes marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter