Pool has free access to all funds without using the redeem method

Lines of code Vulnerability details Impact Pool has access to all funds even if they weren't deposited by the pool Proof of Concept The AAVE yield source contract allows anyone to deposit and withdraw funds that are deposited or withdrawn from AAVE. In the constructor of the contract, max approva...

_setYieldSource does not reset approval

Handle cmichel Vulnerability details The SwappableYieldSource.setYieldSource function approves the new yield source but does not reset the old yield source's approval to zero. It could be the case that the old yield source is compromised or has a bug and could therefore transfer and steal any...

onlyOwnerOrAssetManager can swap Yield Source in SwappableYieldSource at any time, immediately rugging all funds from old yield source

Handle GalloDaSballo Vulnerability details Impact The function swapYieldSource Can be called by the owner deployer / initializer or Asset Manager The function will take all funds from the old Yield Source, and transfer them to the new Yield source. Any contract that implement the function functio...

Old yield source still has infinite approval

Handle tensors Vulnerability details Impact After swapping a yield source, the old yield source still has infinite approval. Infinite approval has been used in large attacks if the yield source isn't perfectly safe see furucombo. Proof of Concept Recommended Mitigation Steps Decrease approval aft...

SafeMath not completely used in yield source contracts

Handle shw Vulnerability details Impact SafeMath is not completely used at the following lines of yield source contracts, which could potentially cause arithmetic underflow and overflow: 1. line 78 in SushiYieldSource 2. line 67 in BadgerYieldSource 3. line 91 and 98 in IdleYieldSource Proof of...

YieldSourcePrizePool_canAwardExternal does not work

Handle cmichel Vulnerability details The idea of YieldSourcePrizePoolcanAwardExternal seems to be to disallow awarding the interest-bearing token of the yield source, like aTokens, cTokens, yTokens. "@dev Different yield sources will hold the deposits as another kind of token: such a Compound's...