search

code-423n4 / 2021-09-yaxis-findings

0 stars 0 forks source link

Strategy is not cap at strategy's cap #24

Closed code423n4 closed 2 years ago

code423n4 commented 3 years ago

Handle

jonah1005

Vulnerability details

Impact

There are no cap checks when depositing (through the vault earn) to the strategy.

Proof of Concept

This is the web3.py script:

print(controller.functions.getCap(vault.address, strategy.address).call())
print(strategy.functions.balanceOf().call())

The output log:

10000000000000000000000
98577584224142208730976

Tools Used

Hardhat

Recommended Mitigation Steps

Add a check in the controller.

Haz077 commented 2 years ago

I think cap is meant only for depositing, not earn.

GalloDaSballo commented 2 years ago

Finding is not properly documented, will agree with sponsor