search

code-423n4 / 2023-07-pooltogether-findings

12 stars 7 forks source link

Malicious Yield Vault could deny Pool Together withdrawing assets #474

Closed code423n4 closed 11 months ago

code423n4 commented 12 months ago

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L254

Vulnerability details

Impact

Since vaults can be created by anyone as long as they provide an ERC-4626 compliant yield source, an attacker could set up a malicious ERC-4626 contract and set that as the yield source for a newly created Vault. The attacker could then have the malicious contract use revert whenever a withdraw call is made to it.

Proof of Concept

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L254

Tools Used

Manual Review

Recommended Mitigation Steps

Assessed type

DoS

c4-judge commented 11 months ago

Picodes marked the issue as duplicate of #324

c4-judge commented 11 months ago

Picodes marked the issue as satisfactory