Core Contracts

Summary

The claimRewards function contains a vulnerability that allows any external actor to claim rewards on behalf of other users. This unrestricted access pattern undermines user autonomy over their reward claiming strategy and timing.

Vulnerability Details

The function's current implementation accepts any user address as a parameter:

Impact

• Although there is no fund lost here, Forced claiming of rewards against user intentions can be done

• Disruption of user-planned yield optimization strategies

Tools Used

• Manual code review

Recommendations

• Modify function to only allow self-claims:

  function claimRewards() external override nonReentrant whenNotPaused returns (uint256) {

  address user = msg.sender;

• Consider implementing delegation system for authorized third-party claims

• Add proper access control mechanisms to restrict claim capabilities