BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing Access Control on Standard ERC4626 Functions

jufel

Description:
The contract overrides deposit() with custom time-based restrictions but does not override other standard ERC4626 functions like mint(), withdraw(), and redeem(). Users can bypass the deposit time restrictions by calling mint() directly, or withdraw at any time using the standard redeem() function.

Impact:

  • Users can bypass eventStartDate restriction by using mint() instead of deposit()

  • Users can bypass winner-based withdrawal restrictions using standard redeem()

  • The custom betting logic is completely bypassed

  • Participation fees can be avoided

Proof of Concept:
Add test to 'briVault.t.sol':

function testBypassLockUsingERC4626Withdraw() public {
// withdraws via inherited ERC4626 interface (not the custom no-arg withdraw())
vm.prank(owner);
briVault.setCountry(countries);
​
vm.startPrank(user1);
mockToken.approve(address(briVault), 20 ether);
uint256 user1Shares = briVault.deposit(20 ether, user1);
assertEq(mockToken.balanceOf(user1) == 0, true);
briVault.joinEvent(10);
// Withdraw before winner set:
briVault.withdraw(10 ether, user1, user1);
vm.stopPrank();
​
assertEq(mockToken.balanceOf(user1) > 0, true, "user1 pulled assets early");
}

Mitigation:

Override and disable or restrict all ERC4626 deposit/withdraw functions:

function mint(uint256 shares, address receiver) public virtual override returns (uint256) {
revert("Use deposit function");
}
​
function withdraw(uint256 assets, address receiver, address owner)
public
virtual
override
returns (uint256)
{
revert("Use custom withdraw function");
}
​
function redeem(uint256 shares, address receiver, address owner)
public
virtual
override
returns (uint256)
{
revert("Use custom withdraw function");
}
Updates

Appeal created

bube Lead Judge 21 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unrestricted ERC4626 functions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!