BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

In `Funciton:deposit`, `_mint` to `msg.sender` instead of `receiver`

zhongguangyang0907

[H-3] In Funciton:deposit, _mint to msg.sender instead of receiver

Description

In Funciton:deposit, _mint to msg.sender instead of receiver:

function deposit(uint256 assets, address receiver) public override returns (uint256) {
require(receiver != address(0));
if (block.timestamp >= eventStartDate) {
revert eventStarted();
}
​
......
​
@> _mint(msg.sender, participantShares);
​
......
}

Impact

Assume that userA wants to deposit asset for userB,
but actually userA receives minted shares istead of userB.

Proof of Concepts

Run the test function below in test/briVault.t.sol:

function test_incorrect_mint_in_deposit() public {
vm.startPrank(user1);
mockToken.approve(address(briVault), 5 ether);
briVault.deposit(5 ether, user2);
vm.stopPrank();
​
assertEq(briVault.balanceOf(user2), 0);
}

Recommended mitigation

function deposit(uint256 assets, address receiver) public override returns (uint256) {
require(receiver != address(0));
if (block.timestamp >= eventStartDate) {
revert eventStarted();
}
​
......
​
- _mint(msg.sender, participantShares);
+ _mint(receiver, participantShares);
​
......
}
Updates

Appeal created

bube Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Shares Minted to msg.sender Instead of Specified Receiver

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!