Submission Details
Severity:
Incorrect Receiver in Deposit Minting
Root + Impact
Description
The deposit function in BriVault.sol overrides the ERC4626 deposit function but incorrectly mints shares to msg.sender instead of the specified receiver parameter. This violates the ERC4626 specification, which requires shares to be minted to the receiver address.
function deposit(uint256 assets, address receiver) public override returns (uint256) {
require(receiver != address(0));
// ... fee and stake calculations ...
@> _mint(msg.sender, participantShares); //@audit Should be _mint(receiver, participantShares)
// ...
}
Risk
Likelihood:
deposits on behalf of others.
Impact:
-
Users depositing on behalf of others will receive shares instead of the intended recipient.
-
Receiver can't join event.
Proof of Concept
function test_DepositMintsToWrongAddress() public {
// Setup: user1 will deposit on behalf of user2
vm.startPrank(user1);
mockToken.approve(address(briVault), 5 ether);
// Get initial balances
uint256 user1SharesBefore = briVault.balanceOf(user1);
uint256 user2SharesBefore = briVault.balanceOf(user2);
console.log("Before deposit:");
console.log(" user1 shares:", user1SharesBefore);
console.log(" user2 shares:", user2SharesBefore);
// User1 deposits 5 ether with user2 as receiver
// Expected: shares should go to user2
// Actual: shares go to user1 (msg.sender)
uint256 sharesMinted = briVault.deposit(5 ether, user2);
uint256 user1SharesAfter = briVault.balanceOf(user1);
uint256 user2SharesAfter = briVault.balanceOf(user2);
console.log("\nAfter deposit(5 ether, user2):");
console.log(" user1 shares:", user1SharesAfter);
console.log(" user2 shares:", user2SharesAfter);
console.log(" shares minted:", sharesMinted);
vm.stopPrank();
assertEq(user1SharesAfter, user1SharesBefore + sharesMinted,
"Shares incorrectly minted to msg.sender (user1)");
assertEq(user2SharesAfter, user2SharesBefore,
"Receiver (user2) did not receive shares");
}
Recommended Mitigation
Fix the minting line to use receiver instead of msg.sender:
function deposit(uint256 assets, address receiver) public override returns (uint256) {
require(receiver != address(0));
if (block.timestamp >= eventStartDate) {
revert eventStarted();
}
uint256 fee = _getParticipationFee(assets);
// charge on a percentage basis points
if (minimumAmount + fee > assets) {
revert lowFeeAndAmount();
}
uint256 stakeAsset = assets - fee;
stakedAsset[receiver] = stakeAsset;
uint256 participantShares = _convertToShares(stakeAsset);
IERC20(asset()).safeTransferFrom(msg.sender, participationFeeAddress, fee);
IERC20(asset()).safeTransferFrom(msg.sender, address(this), stakeAsset);
- _mint(msg.sender, participantShares);
+ _mint(receiver, participantShares);
emit deposited (receiver, stakeAsset);
return participantShares;
}
Updates
Appeal created
bube 19 days ago
Submission Judgement Published Assigned finding tags:
Shares Minted to msg.sender Instead of Specified Receiver
Rewards breakdown
nSLOC
193This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.