BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Shares are never minted to receiver specified making them unable to join the event

nkh000

In briVault.sol::deposit does not mints erc4626 vault shares to receiver making them unable to join the event.

Description

When msg.sender calls the briVault::deposit function then according the documentation of the contract it must mint shares to the receiver as specified in the parameter but it mints them to msg.sender restricting them from joining the event.

  • Normally, receiver must receive the shares as stakeShares to their account as they are designated receiver of the share tokens.

  • However, when user deposits then the msg.sender of the function gets the share tokens which does not align with the documentation of the contract where receiver should receive the tokens on depositing the underlying assets to the vault.

​
uint256 stakeAsset = assets - fee;
​
stakedAsset[receiver] = stakeAsset;
uint256 participantShares = _convertToShares(stakeAsset);
​
IERC20(asset()).safeTransferFrom(
msg.sender,
participationFeeAddress,
fee
);
IERC20(asset()).safeTransferFrom(msg.sender, address(this), stakeAsset);
​
// @audit HIGH mints shares to msg.sender but not to the receiver of the share
_mint(msg.sender, participantShares);
​

Risk : HIGH

Likelihood: HIGH

  • Reason 1 : Happens everytime when deposit is called

  • Reason 2 : receiver does not have any other way to receive shares from the vault other deposit

Impact: HIGH

  • Impact 1 : Makes users unable to join the event

Proof of Concept

Add the following test function snippet to the briVault.t.sol

function test_deposit_POC() public {
address newUser = makeAddr("newUser");
vm.startPrank(user1);
mockToken.approve(address(briVault), 5 ether);
briVault.deposit(5 ether, newUser);
vm.stopPrank();
​
// user 1 has zero shares
assertEq(briVault.balanceOf(newUser), 0); // receives 0 shares but should have received shares
assertEq(briVault.balanceOf(user1), 4925e15); // msg.sender gets shares minted after 3% fee deduction
}

Recommended Mitigation

In briVault::deposit change the following line of code

- _mint(msg.sender, participantShares);
+ _mint(receiver, participantShares);
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Shares Minted to msg.sender Instead of Specified Receiver

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!