Admin rug vector in moveWithheldETH()

Lines of code Vulnerability details According to the documentation, currentWithheldETH is meant to: withhold part of the ETH deposit for future use, such as to earn yield in other places to supplement the ETH 2.0 staking yield The issue is that the owner can call moveWithheldETH with an arbitrary...

recoverEther not updating currentWithheldETH breaks calculation of withheld amount for further deposits

Lines of code Vulnerability details The emergency exit function recoverEther allows the owner to retrieve the ETH in case an issue were to happen. The problem is that this function does not update currentWithheldETH. This means upon deposit starting again after the emergency recovery,...

An attacker taking over the timelock_address or the owner address will result in DoS and unusable contract (frxETHMinter).

Lines of code Vulnerability details Impact Actions described in the POC result in DoS, if an attacker takes over one of the two "admin" addresses. Proof of Concept By taking over the timeLock or the owner address, the attacker will have access to the following functions moveWithheldETH,...

TIMELOCK_ROLE Can Withdraw FUND from the Contracts via recoverEther()

Lines of code Vulnerability details Impact The Timelock Address role is misidentified in this agreement and has high authority. While I believe developer have good intention to use these functions. It often associate with Rug Pull by developer in the eyes of investors because Rug Pull is not...

Risk of ETH funds Rug Pull in the moveWithheldETH and recoverEther functions

Lines of code Vulnerability details Impact In the frxETHMinter contract both the owner and governance timelock have the power to call the functions moveWithheldETH and recoverEther, those functions allow the transfer of the ETH from frxETHMinter to the owner or a given account, this means that th...

It's possible to send tokens to an unwanted wallet

Lines of code Vulnerability details Impact recoverEther and recoverERC20 could send tokens to a lost wallet. Proof of Concept In the contract frxETHMinter, the methods recoverEther and recoverERC20 doesn't receive the destination address, it sends the ether to the owner, but it is possible that t...