Sender in `transferFrom` in `Lender.setPool` different from msg.sender
Summary
The method setPool in Lender.sol uses p.lender as sender in the transferFrom method. This can be exploited to make the contract transfer tokens on behalf p.lender, potentially leading to unauthorized token transfers.
Vulnerability Detail
In the function Lender.setPool(Pool), there's a call to IERC20(p.loanToken).transferFrom(p.lender, address(this), p.poolBalance - currentBalance). By using p.lender as the sender, this can be exploited to bypass proper access controls.
Impact
Unexpected deductions or transfers for users.
Tools Used
Slither
Recommendation:
Replace p.lender with msg.sender to ensure that the transaction initiator is the one being validated.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.