ak1 - Redeemer.sol: autoRedeem can be called by anyone with valid input to take the incentivefee

[sherlock-admin]

ak1

medium

Redeemer.sol: autoRedeem can be called by anyone with valid input to take the incentivefee

Summary

The autoRedeem function in redeemer.sol can be called by anyone with valid input parameters. The caller can take away the incentive fee.

Vulnerability Detail

In the current implementation of autoRedeem, the function can be called by anyone with valid input. The input could be matured market data. The caller can take away the incentive fee.

Impact

Anyon can take away the incentive fee.

In one of situation, let's say Alice has the valid data and submitting for transaction. Bob as a miner can use the data from the transaction and submit fresh transaction with high gas fee and complete it and take away the incentive fee.

Code Snippet

https://github.com/sherlock-audit/2022-10-illuminate/blob/main/src/Redeemer.sol#L485-L548

Tool used

Manual Review

Recommendation

Implement a mechanism such that the caller has any sort of approval from the owners.

[sourabhmarathe]

This is the intention of autoRedeem - we expect anyone to be able to come in and conduct the redemption on behalf of the users after maturity.