Submission Details
Severity:
Anyone can modify the yields.
Summary
Anyone can modify the yields.
Vulnerability Details
This means that anyone can modify yields, and gain more than set by authenticated admins.
https://github.com/Cyfrin/2023-09-ditto/blob/a93b4276420a092913f43169a353a6198d3c21b9/contracts/facets/YieldFacet.sol#L41C1-L73C6
Impact
Loss of Yields
Tools Used
Manual Review
Recommendations
Create a Role Based Access Control for admins
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.