Submission Details
Severity:
permission management vulnerability
Summary
In KittyPool, function purrgeBadPawsition haven't check msg.sender
Vulnerability Details
function purrgeBadPawsition(address _user) external returns (uint256 _totalAmountReceived) {
require(!(_hasEnoughMeowllateral(_user)), KittyPool__UserIsPurrfect());
...
for (uint256 i; i < vaults_length; ) {
...
_vault.executeWhiskdrawal(msg.sender, toDistribute + extraReward);
unchecked {
++i;
}
}
}
anyone can call this fonction when they find someone doesn't have enough money to repay and the money will send to hacker.
Impact
the peopol who have not enough meowllateral can be burn by hcker and money will sende to hacker
Tools Used
vscode
Recommendations
add a modifire
function purrgeBadPawsition(address _user) external onlyMeowntainer returns (uint256 _totalAmountReceived)
Rewards breakdown
nSLOC
224This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.