Handle

gpersoon

Vulnerability details

Impact

The contract SwappableYieldSource is upgradable. This means the owner could upgrade and change the contract so any new functionality.
Amongst others the owner could retrieve all the tokens of the Yieldsource and transfer them out.

The project could still be called out for be able to be rug pulled resulting in a reputation risk, see for example:
<https://twitter.com/RugDocIO/status/1411732108029181960&gt;

Proof of Concept

//<https://github.com/pooltogether/swappable-yield-source/blob/main/contracts/SwappableYieldSource.sol#L19&gt;
contract SwappableYieldSource is ERC20Upgradeable, IYieldSource, AssetManager, ReentrancyGuardUpgradeable {

Tools Used

Recommended Mitigation Steps

Accept the risk and note it in the comments.
Or change to a non upgradable contract.

The text was updated successfully, but these errors were encountered:

All reactions