Submission Details
Severity:
callExternalContract method can drain the contract
Summary
callExternalContract method can be called into any token contract approving it to the max, which in turn loses the total accounting of the protocol's funds
Vulnerability Details
The callExternalContract method can be used by EXTERNAL_CALLER to approve max funds of contract to any address and drain the balances of various tokens in the contract
Impact
The contract's funds are lost
Tools Used
manual analysis
Recommendations
have a whitelisted set of contracts to call so unintended effects can be avoided
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.