The PoolBase.unstakeWindowExpiry function allows unstaking tokens of other users.
While the tokens are sent to the correct address, this can lead to issues with smart contracts that might rely on claiming the tokens themselves.
For example, suppose the _to address corresponds to a smart contract that has a function of the following form:
Handle
cmichel
Vulnerability details
The
PoolBase.unstakeWindowExpiry
function allows unstaking tokens of other users. While the tokens are sent to the correct address, this can lead to issues with smart contracts that might rely on claiming the tokens themselves.For example, suppose the
_to
address corresponds to a smart contract that has a function of the following form:If the contract has no other functions to transfer out funds, they may be locked forever in this contract.