Lines of code

Vulnerability details

Impact

Lack of access-control allows anyone to mint the yield fee to himself.

Proof of Concept

Vault.mintYieldFee does not restrict the _recipient yield fees:

  function mintYieldFee(uint256 _shares, address _recipient) external {
    _requireVaultCollateralized();
    if (_shares > _yieldFeeTotalSupply) revert YieldFeeGTAvailable(_shares, _yieldFeeTotalSupply);

    _yieldFeeTotalSupply -= _shares;
    _mint(_recipient, _shares);

    emit MintYieldFee(msg.sender, _recipient, _shares);
  }

Tools Used

Manual Review

Recommended Mitigation Steps

Dont use an extra parameter for the recipient and use the contracts _yieldFeeRecipient instead.

Assessed type

Access Control

The text was updated successfully, but these errors were encountered:

All reactions