Closed c4-submissions closed 10 months ago
GalloDaSballo marked the issue as unsatisfactory: Invalid
GalloDaSballo removed the grade
GalloDaSballo changed the severity to QA (Quality Assurance)
This is wrong, eth is passed along in the callback here: https://github.com/code-423n4/2023-09-delegate/blob/main/src/libraries/DelegateTokenLib.sol#L92
0xfoobar (sponsor) disputed
GalloDaSballo marked the issue as grade-c
Lines of code
https://github.com/code-423n4/2023-09-delegate/blob/a6dbac8068760ee4fc5bababb57e3fe79e5eeb2e/src/DelegateToken.sol#L389
Vulnerability details
DelegateToken.flashloan
function is marked aspayable
which means it can receive Ether during its execution. However, there is no mechanism in the function to handle or refund the received ETH. If a user accidentally sends ETH along with the function call, the ETH will be locked in the contract forever, leading to a loss of funds. It's can be avoided by removing thepayable
marker if the function is not intended to receive ETH.Assessed type
Payable