Closed code423n4 closed 2 years ago
The Treasury contract and it's associated mixins were labeled as out-of-scope.
Also this report is invalid -- see https://github.com/code-423n4/2022-08-foundation-findings/issues/275#issuecomment-1215761575
Dup of #275
Lines of code
https://github.com/code-423n4/2022-08-foundation/blob/792e00df429b0df9ee5d909a0a5a6e72bd07cf79/contracts/FoundationTreasury.sol#L61
Vulnerability details
Proof of concept
FoundationTreasury.sol
inheritsCollateralManagement.sol
which has the methodthat can withdraw the whole balance of the treasury to the
to
address. It looks like it is protected because it has theonlyAdmin
modifier, which comes fromAdminRole.sol
. The problem is that thegrantAdmin()
method inAdminRole.sol
is not protected and is external, so anyone can make himself an admin and callwithdrawFunds
, which results in stolen funds from the treasury.Impact
The severity is critical and the impact is very serious, because the attack is easy to execute and it can result in 100% of the treasury funds getting stolen.
Recommendation
Revisit the
AdminRole.sol
smart contract and add access control tograntAdmin()
method. You can make it so that only already set admins (like the one set in_initializeAdminRole()
) can set new admins.