BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

deposit() Mints Shares to Wrong Address, Ignoring Receiver Parameter

eagerpanda582

Root + Impact

Description

  • Normal Behavior: The deposit() function allows a user to deposit assets on behalf of a specified receiver address. The intended behavior is to mint vault shares to the receiver, not necessarily the sender.

  • Specific Issue: In the current implementation, _mint() always mints shares to msg.sender instead of the receiver. This means that the depositor may pay tokens, but another address (the sender) receives the vault shares, breaking the intended ownership mapping.

function deposit(uint256 assets, address receiver) public override returns (uint256) {
require(receiver != address(0));
...
uint256 participantShares = _convertToShares(stakeAsset);
​
IERC20(asset()).safeTransferFrom(msg.sender, participationFeeAddress, fee);
IERC20(asset()).safeTransferFrom(msg.sender, address(this), stakeAsset);
​
_mint(msg.sender, participantShares); // @> shares minted to msg.sender instead of receiver
​
emit deposited(receiver, stakeAsset);
return participantShares;
}
​

Risk

Likelihood:

  • Likely whenever a depositor intends to deposit for another user by specifying the receiver parameter.

  • High likelihood because _mint() ignores the receiver argument and always uses msg.sender.

Impact:

  • The depositor pays the assets, but shares are assigned to the wrong address, potentially leading to loss of funds or misallocation of vault shares.

  • Could be exploited in scenarios where contracts or users deposit on behalf of another, breaking intended reward distribution.

Proof of Concept

Not Required

Recommended Mitigation

- _mint(msg.sender, participantShares);
+ _mint(receiver, participantShares);
​

Additional Recommendations:

  • Ensure that all relevant events (like deposited) match the actual share ownership (receiver).

Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Shares Minted to msg.sender Instead of Specified Receiver

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!