Submission Details
Severity:
Any User may request to delete vault or delete vault on operatorVCS
Vulnerability Details
The Contract OperatorVCS contains two functions for vault but no access control.
it allows any user request to delete the vault then when vault is requested the user may use other function to delete the vault
function queueVaultRemoval(uint256 _index) external
function removeVault(uint256 _queueIndex) public
Impact
Loss of funds or assets
Attacker may griefing the users
Tools Used
Visual Studio Code - Manual Review
Recommendations
Use OnlyOwner (Modifier) For removeVault
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
2,53020 USDC / LOC
42,000 USDC
4,250 USDC
3,750 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.