The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Check absent for preventing owner to be recipient

saaj

Summary

Functions related to removal of collateral and asset does not check for from != to.

Vulnerability Details

Important function removeCollateralNative, removeCollateral and removeAsset does not have any check to prevent Owner from transferring funds to himself.

Impact

removeCollateralNative, removeCollateral and removeAsset functions are only callable by the owner of the contract which can be lead to loss of funds for stakers, as these function can be used by owner to transfer all asset to himself.

Tools Used

Manual code review

Recommendation

The recommendation is made for all three functions removeCollateralNative, removeCollateral and removeAsset of SmartVaultV3 to have check for preventing the owner to set himself as the recipient of collateral and asset when removing them.

require(msg.sender != onlyOwner, ‘Owner cannot be recipient’);
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

informational/invalid

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.