0xboriskataa - Incorrect input of parameters for the `StakingRewardsManager.sol: recoverERC20` function call

[sherlock-admin]

0xboriskataa

medium

Incorrect input of parameters for the StakingRewardsManager.sol: recoverERC20 function call

Summary

The recoverERC20 function in StakingRewardsManager.sol takes 3 parameters as input in this exact order: IERC20 tokenAddress, uint256 tokenAmount address to. However recoverERC20FromStaking calls recoverERC20 with misplaced parameters: staking.recoverERC20(to, tokenAddress, tokenAmount);

Vulnerability Detail

Impact

Code Snippet

function recoverERC20(
        IERC20 tokenAddress,
        uint256 tokenAmount,
        address to
    ) external onlyRole(SUPPORT_ROLE) {
        //move funds
        tokenAddress.safeTransfer(to, tokenAmount);
    }

function recoverERC20FromStaking(
        StakingRewards staking,
        IERC20 tokenAddress,
        uint256 tokenAmount,
        address to
    ) external onlyRole(SUPPORT_ROLE) {
        // grab the tokens from the staking contract
        staking.recoverERC20(to, tokenAddress, tokenAmount);
    }

Tool used

Manual Review

Recommendation

-        *staking.recoverERC20(to, tokenAddress, tokenAmount);
+        *staking.recoverERC20(tokenAddress, tokenAmount, to);

Duplicate of #173

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

takarez commented:

invalid because { This is invalid because the recoverERC20() function thats being called is from stakinRewards.sol not TelcoinDistributor.sol; so the implementation is correct.so its invalid}