Anyone can call the Pool.transferLPs function and transfer previously approved LP tokens to the approved address.
Vulnerability Detail
The Pool.transferLPs function allows to transfer LP tokens from one address to another. Even though it requires approving a transfer, actual transferring is left at the discretion of the approved address: approving allows the approved address to transfer LP tokens when appropriate. However, since the Pool.transferLPs function can be called by any address, the owner of the tokens may be impacted.
Impact
Lender's LP tokens may be transferred to an approve address at an inappropriate time, impacting the position management strategy of the lender.
Jeiwan
medium
Anyone can transfer approved LP tokens
Summary
Anyone can call the
Pool.transferLPs
function and transfer previously approved LP tokens to the approved address.Vulnerability Detail
The Pool.transferLPs function allows to transfer LP tokens from one address to another. Even though it requires approving a transfer, actual transferring is left at the discretion of the approved address: approving allows the approved address to transfer LP tokens when appropriate. However, since the
Pool.transferLPs
function can be called by any address, the owner of the tokens may be impacted.Impact
Lender's LP tokens may be transferred to an approve address at an inappropriate time, impacting the position management strategy of the lender.
Code Snippet
Pool.sol#L238
Tool used
Manual Review
Recommendation
Consider allowing calling the
Pool.transferLPs
function only to theowner
ornewOwner_
.