Unauthorized Access to Vault Deployment via External performUpkeep Function
Summary
The performUpkeep function in the CommunityVCS contract is marked as external, potentially allowing unauthorized users to trigger vault deployments.
Vulnerability Details
Function Access: The
performUpkeepfunction is accessible to any external caller.Potential Misuse: Without access control, unauthorized entities could deploy new vaults, leading to unexpected behavior or resource allocation.
Impact
Unauthorized Vault Deployment: Could result in unnecessary or malicious vault creation, impacting system resources and functionality.
Tools Used
Manual Review
Recommendations
Access Control: Implement access restrictions using modifiers like onlyOwner or a custom modifier to limit who can call performUpkeep
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.