Griefing attack is possible, an attacker can can remove all vaultIds from an arbitrary account. I.e. anyone can mix up vault configuration for any user.
Proof of Concept
ConvexYieldWrapper.removeVault doesn't have access controls and allows anyone to manage vaults of an account chosen:
Handle
hyh
Vulnerability details
Impact
Griefing attack is possible, an attacker can can remove all
vaultId
s from an arbitraryaccount
. I.e. anyone can mix up vault configuration for any user.Proof of Concept
ConvexYieldWrapper.removeVault doesn't have access controls and allows anyone to manage vaults of an account chosen:
https://github.com/code-423n4/2022-01-yield/blob/main/contracts/ConvexYieldWrapper.sol#L71-95
ConvexModule.removeVault has the same issue:
https://github.com/code-423n4/2022-01-yield/blob/main/contracts/ConvexModule.sol#L27-33
Recommended Mitigation Steps
Consider adding a controller role that can manage user's vaults.
A version of the functionality without access controls, if needed, should operate
msg.sender
account only.