hats-finance / Smooth-0x64bc275b37e62eec81a00ecaecd2b9567058f990

Dappnode's MEV Smoothing Pool
0 stars 2 forks source link

Prevent msg.sender to set himself as reward recipient. #37

Open hats-bug-reporter[bot] opened 1 year ago

hats-bug-reporter[bot] commented 1 year ago

Github username: -- Submission hash (on-chain): 0xbd9d03097ba8802700da1cbe677718f13d8465caa294b375c3ac930723ab7a4f Severity: low

Description: Description\ Check must be placed to ensure msg.sender does not set itself as the recipient of the reward.

Attachments

https://github.com/dappnode/mev-sp-contracts/blob/3929e24ea288d697d38948b8690c8c2028e5042b/contracts/DappnodeSmoothingPool.sol#L342

Recommendation

Check must be placed to ensure that msg.sender does not set themself as recipient of the reward.

    function setRewardRecipient(address rewardAddress) external {
+   require(msg.sender != rewardAddress, ‘msg.sender cannot be reward Recipient’ );
rewardRecipient[msg.sender] = rewardAddress;
emit SetRewardRecipient(msg.sender, rewardAddress);
    }
invocamanman commented 1 year ago

This check is unnecessary, since even if usually does not "make sense" it's possible to do it. Also take in aware if a msg.sender previously set another reward recipient, and now wants to change it for himself, this allows to do it ^^