code-423n4 / 2022-03-lifinance-findings

6 stars 4 forks source link

admin can rug #186

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-03-Li.finance/blob/main/src/Facets/WithdrawFacet.sol#L20

Vulnerability details

admin can steal all user funds

maxklenk commented 2 years ago

The contract does not hold any user funds. The withdraw function is only added to withdraw funds to the users that accidentally ended up in the contract.

gzeoneth commented 2 years ago

Duplicate of https://github.com/code-423n4/2022-03-lifinance-findings/issues/65