Submission Details
Severity:
Shares Minted to `msg.sender` Instead of `receiver`
Description
-
ERC4626
depositshould credit shares to thereceiverargument for delegated deposits. -
Implementation logs stake under
receiverbut calls_mint(msg.sender, shares), so downstream logic tied tobalanceOf(receiver)breaks.
// src/briVault.sol:220-233
stakedAsset[receiver] = stakeAsset;
...
@> _mint(msg.sender, participantShares);
Risk
Likelihood:
-
Any integration or custodian depositing on behalf of users (a standard pattern) will trigger it.
-
There is no UI or contract guard preventing delegated deposits.
Impact:
-
Receivers cannot join or withdraw because they lack shares, locking their funds.
-
Senders hold shares but never set a country, so their assets are equally stuck.
Proof of Concept
alice.deposit(100 ether, bob);
bob.joinEvent(1);
owner.setWinner(1);
bob.withdraw(); // shares == 0, receives nothing despite funding the pool
Recommended Mitigation
- _mint(msg.sender, participantShares);
+ _mint(receiver, participantShares);
Updates
Appeal created
bryanconquer 19 days ago
Submission Judgement Published Assigned finding tags:
Shares Minted to msg.sender Instead of Specified Receiver
Rewards breakdown
nSLOC
193This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.