search

tokamak-network / gem-nft-contract

Project Opal contract repository
MIT License
7 stars 4 forks source link

[Code review: Contract Bugs]: Ownership verification required in 'requestWithdrawalTo' #34

Closed Zena-park closed 1 month ago

Zena-park commented 1 month ago

Describe the bug

What someone has staked can be unstaken by another person.

https://github.com/tokamak-network/gem-nft-contract/blob/b31e833a38901bee6287b869d34c523bfe13dea2/src/L1/L1WrappedStakedTON.sol#L128-L131

Impact

Any user can unstake someone else's stake.

Exploit Scenario

No response

Recommendation

When should we use the requestWithdrawalTo function? If we don't need it, it's better to remove it.

mehdi-defiesta commented 1 month ago

Thanks @Zena-park. Here's the contract update : Link

Zena-park commented 1 month ago

I confirmed. Thank you.