Lines of code

Vulnerability details

Impact

In the claimRewards function, manager or owner can send rewards to any address.

  function claimRewards(address _to) external onlyManagerOrOwner returns (bool) {
    require(_to != address(0), "AaveV3YS/payee-not-zero-address");

    address[] memory _assets = new address[](1);
    _assets[0] = address(aToken);

    (address[] memory _rewardsList, uint256[] memory _claimedAmounts) = rewardsController
      .claimAllRewards(_assets, _to);

    emit Claimed(msg.sender, _to, _rewardsList, _claimedAmounts);
    return true;
  }

#Proof of Concept

Tools Used

None

Recommended Mitigation Steps

Consider the claimRewards function to send rewards to a fixed reward distribution contract

The text was updated successfully, but these errors were encountered:

All reactions