Submission Details
Severity:
`withdrawUSDC` function not permissioned in modules
Summary
depositUSDC is external therefore, users can call this to withdraw USDC and to burn CrimeMoney without updating accounts of the module Shelf.sol
Vulnerability Details
function withdrawUSDC(address account, address to, uint256 amount) external {
withdraw(account, amount);
crimeMoney.burn(account, amount);
usdc.transfer(to, amount);
}
Impact
Misalignment between accounts balances in the Shelf contract and all the real movements
Tools Used
Manual review
Recommendations
To make the function permissioned.
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.