Beedle - Oracle free perpetual lending
BeedleFi
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Lacks access control for the function `sellProfits()`

Bauer

Summary

Lacks access control for the function sellProfits()

Vulnerability Details

The sellProfits() function is used to sell a specific token (other than WETH) that the contract holds, in exchange for WETH. The acquired WETH is then transferred to a staking address.
The function sellProfits() does not include any access control mechanisms, such as a modifier or a requirement to check the caller's permissions. This means that any address could potentially call this function without restriction.
When a user calls the Staking.claim() function, they may obtain more WETH.

function sellProfits(address _profits) public {
require(_profits != WETH, "not allowed");
uint256 amount = IERC20(_profits).balanceOf(address(this));
​
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
amountOutMinimum: 0,
sqrtPriceLimitX96: 0
});
​
amount = swapRouter.exactInputSingle(params);
IERC20(WETH).transfer(staking, IERC20(WETH).balanceOf(address(this)));
}
​

Impact

User may obtain more WETH

Tools Used

Vscode

Recommendations

Implement access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.