stake.link

Vulnerability Details

In RewardsInitiator.sol:83, the function performUpkeep is implemented without a check to ensure it is called by an authorized keeper. This omission allows any external entity to call this function, the function receives a bytes array to perform the work and even when further analysis didn't show it can be used to perform some kind of attack it would be advisable to ensure only the authorized keeper calls this function.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, it is recommended to add a modifier that checks if the caller is an authorized keeper.