Anyone can create vaults and remove vaults from anyone.
Proof of Concept
The contract ConvexYieldWrapper expose two methods:
addVault show in his comment Adds a vault to the user's vault list but according to the code it not use the users vault, it use owner vault, sender was not checked (not very risky).
removeVault show in his comment Remove a vault from the user's vault list but it's possible for anyone to remove a vault from anyone, it doesn't care about if the vault is yours or not, you only need to specify the owner in the argument account.
Handle
0x1f8b
Vulnerability details
Impact
Anyone can create vaults and remove vaults from anyone.
Proof of Concept
The contract
ConvexYieldWrapper
expose two methods:addVault
show in his commentAdds a vault to the user's vault list
but according to the code it not use the users vault, it use owner vault, sender was not checked (not very risky).removeVault
show in his commentRemove a vault from the user's vault list
but it's possible for anyone to remove a vault from anyone, it doesn't care about if the vault is yours or not, you only need to specify the owner in the argumentaccount
.Tools Used
Manual review.
Recommended Mitigation Steps
Add auth mechanism for add and remove methods.