Lines of code

Vulnerability details

Impact

Owner can remove a depositor. Since only depositors can deposit and withdraw, the owner may add a contract to the whitelist, let users deposit in the contarct and remove the depositor from the whitelist. Depositor’s reward cannot be withdrawn then. And takes a share of Concur tokens that will not be ditributed.

Tools Used

Manual analysis

Recommended Mitigation Steps

Remove onlyDepositor modifier from the withdraw function.

The text was updated successfully, but these errors were encountered:

All reactions