Submission Details
Severity:
The LendingPool has no method to call the 'rescueToken' function
Vulnerability Details
contract : RToken
rescueTokenfunction is defined to rescue any tokens mistakenly sent to the RToken contract
excluding the RTkoen itself.
This function enforces a onlyReservePoolmodifier,
which means the only allowed caller of this function is the LendingPool
The issue is , the absence of any method in LendingPool to call this rescueTokenfunction.
So there is no way to rescue the mistakenly sent tokens.
Recommendation
Add a function inside LendingPool to facilitat calling the rescueToken function
Updates
Lead Judging Commences
inallhonesty 7 months ago
Submission Judgement Published Assigned finding tags:
RToken::rescueToken() can never be called
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.