code-423n4 / 2022-01-yield-findings

1 stars 0 forks source link

Lack of auth for vaults #61

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

0x1f8b

Vulnerability details

Impact

Anyone can create vaults and remove vaults from anyone.

Proof of Concept

The contract ConvexYieldWrapper expose two methods:

addVault show in his comment Adds a vault to the user's vault list but according to the code it not use the users vault, it use owner vault, sender was not checked (not very risky).
removeVault show in his comment Remove a vault from the user's vault list but it's possible for anyone to remove a vault from anyone, it doesn't care about if the vault is yours or not, you only need to specify the owner in the argument account.

Tools Used

Manual review.

Recommended Mitigation Steps

Add auth mechanism for add and remove methods.

iamsahu commented 2 years ago

Duplicate of #4

GalloDaSballo commented 2 years ago

The finding is invalid as per the discussion on #4 Additionally the entire logic is basically a cache and doesn't seem to have much impact