Submission Details
Severity:
Anyone can claim on behalf of others in `TempleGoldStaking`
Summary
In TempleGoldStaking, there's no access control on the function getReward, anyone can call getReward on behalf of others even if the staker is not will to do so.
Vulnerability Details
In TempleGoldStaking, there's no access control on the function getReward.
/**
* @notice Get rewards
* @param staker Staking account
* @param index Index
*/
function getReward(address staker, uint256 index) external override updateReward(staker, index) {
_getReward(staker, staker, index);
}
As a result, anyone can call getReward on behalf of others even if the staker is not will to do so.
Impact
This may violate the staker's own intention and thus cause bad user experience.
Tools Used
Manual
Recommendations
Add a check require(staker==msg.sender);
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.