Petite Flint Nuthatch - `Voter`::`emitWithdraw()` lacks of access control

[sherlock-admin4]

Petite Flint Nuthatch

Low/Info

Voter::emitWithdraw() lacks of access control

Summary

In Voter contract, emitDeposit() function has an access control which restricts msg.sender, however emitWithdraw() doesn't have such.

Vulnerability Detail

anyone can call emitWithdraw() to add withdraw log for arbitrary account.

Impact

If developer relys on emit log to do some offchain work, then an attacker may exploit it to mess the record.

Code Snippet

https://github.com/sherlock-audit/2024-06-velocimeter/blob/63818925987a5115a80eff4bd12578146a844cfd/v4-contracts/contracts/Voter.sol#L449-L451

Tool used

Manual Review

Recommendation

add require(isGauge[msg.sender]); and require(isAlive[msg.sender]);