stake.link
stake.link
DeFiHardhatBridge
27,500 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Prevent owner to recipient

saaj

Summary

recoverTokens function related to removing of tokens accidently sent does not check for from != to.

Vulnerability Details

Important function recoverTokens does not have any check to prevent Owner from transferring funds to himself.

Impact

recoverTokens functions are only callable by the owner of the contract which can be lead to loss of funds for stakers, as these function can be used by owner to transfer all asset to himself.

Tools Used

Manual code review

Recommendation

The recommendation is made for recoverTokens() of SDLPoolCCIPController to have check for preventing the owner to set himself as the recipient of tokens when recovering them.

function recoverTokens(address[] calldata _tokens, address _receiver) external onlyOwner {
+ require(_receiver != onlyOwner, ‘Owner cannot be receiver’);
if (_receiver == address(0)) revert InvalidReceiver();
for (uint256 i = 0; i < _tokens.length; ++i) {
IERC20 tokenToTransfer = IERC20(_tokens[i]);
tokenToTransfer.safeTransfer(_receiver, tokenToTransfer.balanceOf(address(this)));
}
}
Updates

Lead Judging Commences

0kage Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.