Lines of code

Vulnerability details

Impact

When calling claim() on LendingLedger, the claim reward can be inaccessible if msg.sender is a smart contract with no fallback/receive function. Indeed, msg.sender.call{value: cantoToSend}(“”) would fail and the claim would revert, not allowing the user to recover his claimable rewards.

Tools Used

None.

Recommended Mitigation Steps

Add a mapping address=>address delegateRewards and associated external function to allow a smart contract account to delegate its reward to another address which could recover its attributed rewards.

Assessed type

ETH-Transfer

The text was updated successfully, but these errors were encountered:

All reactions