Skip to content
This repository has been archived by the owner on May 26, 2023. It is now read-only.

Prefix - feeRecipient can be set to unavailable address, leading to losing funds with withdrawFees #7

Closed
github-actions bot opened this issue Nov 15, 2022 · 0 comments
Labels

Comments

@github-actions
Copy link

Prefix

low

feeRecipient can be set to unavailable address, leading to losing funds with withdrawFees

Medium- feeRecipient can be set to unavailable address, leading to losing funds with withdrawFees

https://github.com/sherlock-audit/2022-10-rage-trade/blob/main/dn-gmx-vaults/contracts/vaults/DnGmxJuniorVault.sol#L294-L311 .

Owner can set the feeRecipient to unavailable address, e.g. 0 by mistake. The next call to withdrawFees loses all the accumulated fees from contract. Even if the owner quickly recognizes the mistake, malicious actor can frontrun next call to setFeeParams with withdrawFees.

Remediation

Consider setting the feeRecipient in two steps like in following example: OpenZeppelin/openzeppelin-contracts#3620 .

@github-actions github-actions bot added the Low label Nov 15, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

0 participants