[H-01] Fees collected can be sent to any address
Summary
The feeReceiver variable is declared in the constructor by the msg.sender it should be initialized with the address of the Fees contract.
Vulnerability Details
By not initializing the feeReceiver variable, the fees can be sent to the contract owner and not to the Fees.sol contract that allows the exchange of tokens and take it to the staking contract.
With the initialization you had of msg.sender this would not happen.
Impact
You would not be using the Fees.sol and Staking.sol contracts, preventing the correct functioning of the Lender contract.
Tools Used
Manual code review
Recommendations
Pass through the constructor the address of the contract Fees.sol
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.