code-423n4 / 2022-01-sherlock-findings

0 stars 0 forks source link

Sherlock: Decouple yield strategy with withdrawals #223

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

GreyArt

Vulnerability details

Impact

If there are funds remaining in an old strategy, there is only 1 way to claim those funds which is through Sherlock.updateYieldStrategy() . It is quite an inconvenience to do this.

Recommended Mitigation Steps

Create an additional function to allow anyone to call withdraw / withdraw all from an old strategy. The withdrawn funds should be sent to SherlockCore e.g.

function oldStrategyWithdrawAll(IStrategyManager _oldStrategy) external override {
    _oldStrategy.withdrawAll();
}
CloudEllie commented 2 years ago

Duplicate of #76