search

sherlock-audit / 2024-06-magicsea-judging

8 stars 5 forks source link

Lone Opaque Mustang - `emergencyWithdraw()` sends funds to `msg.sender` which may not be the NFT owner #710

Closed sherlock-admin3 closed 4 months ago

sherlock-admin3 commented 4 months ago

Lone Opaque Mustang

Low/Info

emergencyWithdraw() sends funds to msg.sender which may not be the NFT owner

Summary

emergencyWithdraw() can be called by a whitelisted operator address in _unlockOperators, sending locked funds to them instead of the NFT owner.

Vulnerability Detail

_unlockOperators is a set of addresses that are allowed to forcibly unlock locked NFTs. In emergencyWithdraw(), this could be called by these operators, but the locked funds are transferred to the caller, which would be these operators, instead of the intended recipient, the NFT owner.

Impact

Fund transfer to incorrect recipient.

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/MlumStaking.sol#L559

Tool used

Manual Review

Recommendation

stakedToken should be transferred to the NFT owner.