search

manifoldfinance / mevETH2

mevETH LST Protocol - Repo has migrated see link
https://github.com/MEV-Protocol/meveth
27 stars 2 forks source link

- `grantRewards()` Missing access control #212

Closed ControlCplusControlV closed 11 months ago

sandybradley commented 1 year ago

I contest this is an issue.

Expected sources of reward payments are WagyuStaker and MevEthShareVault. These originally were checked but could not account for the edge cases where these contracts are upgraded but old ones still receive rewards. In that case eth is locked in the old contracts. In the end, we deduced that unless there was an attack vector (assuming operators would use mev relays for granting rewards), it didn't matter who granted rewards, so it was simplified by taking the checks out.

sambacha commented 11 months ago

This issue was fixed https://github.com/kebabsec/review-manifold/issues/23