code-423n4 / 2021-05-nftx-findings

1 stars 0 forks source link

Hypervisor.stake does not transfer tokens #122

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

Vulnerability Details

The Hypervisor's stake action states:

token transfer: transfer staking tokens from msg.sender to vault

But no tokens are ever transferred.

Impact

Anyone with a permission can lock any amount of tokens.

Recommended Mitigation Steps

Transfer the tokens or clarify how this comment is supposed to be understood.