Closed code423n4 closed 2 years ago
It is a weird use case to build a vault, add it to the wrapper, then remove it from the wrapper in the same transaction. However, it is a valid transaction, and if we ever need it, it would be disconcerting not to do it.
@alcueca can you please confirm whether you implemented the suggestion or not?
When implementing a fix, we realized that the finding is not valid.
addVault(0)
will revert because the vault needs to exist in the Cauldron.
removeVault(0, 0x0000)
will revert because the owner of a non-existing vault is address(0)
.
removeVault(0, 0x1234)
will revert because 0x1234 would have needed to add vault 0 first.
Per the sponsor comment calling with 0 as input will cause a revert at the cauldron level.
In lack of a POC, am marking the finding invalid
Handle
0x1f8b
Vulnerability details
Proof of Concept
removeVault
inConvexYieldWrapper
doesn't throw any error withaccount=address(0)
so user wont be noticie if he use: