The Yearn yield source defines maxLosses as: “Max % of losses that the Yield Source will accept from the Vault in BPS” and uses a setter setMaxLosses() to allow owner to set this value. However, the threshold check implemented only checks if this value is less than 10_000 or 100%, which is a good sanity check but allows loss of even 100%. The buffer for the loss is to avoid funds being locked in the Yearn vault in any emergency situation.
Impact: If the losses are really high for some reason, it will impact the interest and the prizes.
Handle
0xRajeev
Vulnerability details
Impact
The Yearn yield source defines maxLosses as: “Max % of losses that the Yield Source will accept from the Vault in BPS” and uses a setter setMaxLosses() to allow owner to set this value. However, the threshold check implemented only checks if this value is less than 10_000 or 100%, which is a good sanity check but allows loss of even 100%. The buffer for the loss is to avoid funds being locked in the Yearn vault in any emergency situation.
Impact: If the losses are really high for some reason, it will impact the interest and the prizes.
Proof of Concept
https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/yield-source/YearnV2YieldSource.sol#L28-L29
https://github.com/code-423n4/2021-06-pooltogether/blob/85f8d044e7e46b7a3c64465dcd5dffa9d70e4a3e/contracts/yield-source/YearnV2YieldSource.sol#L96
Tools Used
Manual Analysis
Recommended Mitigation Steps
Perform a tighter upper threshold check to allow a more acceptable max loss value in setMaxLosses()