code-423n4 / 2024-02-thruster-findings

2 stars 1 forks source link

ThrusterTreasure doesn't have ability to claim native yield #11

Closed c4-bot-3 closed 7 months ago

c4-bot-3 commented 7 months ago

Lines of code

https://github.com/code-423n4/2024-02-thruster/blob/main/thruster-protocol/thruster-treasure/contracts/ThrusterTreasure.sol#L72

Vulnerability details

Proof of Concept

When ThrusterTreasure is constructed then it configures automatic yield mode for native eth, weth, usdb and claimable gas.

Contract has ability to claim yield for weth and usdb and ability to claim gas.

But it has no ability to claim native eth yield. This yield will be accruing, because contract is going to have eth on balance to be able to pay for pyth entropy. Thus yield will be unclaimable and will be lost.

Impact

Lost of yield for protocol.

Tools Used

VsCode

Recommended Mitigation Steps

Create function that will claim native yield.

Assessed type

Error

c4-bot-7 commented 7 months ago

Withdrawn by rvierdiiev