Submitted by kirk-baird
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VoterProxy.sol#L274-L285
https://github.com/code-423n4/2022-05-vetoken/blob/2d7cd1f6780a9bcc8387dea8fecfbd758462c152/contracts/VoterProxy.sol#L123-L143
The owner of VoterProxy is able to call setOperator() (if the previous operator is shutdown). This allows them to then call execute(), withdraw() or withdrawAll().
Execute makes a call to any arbitrary contract with arbitrary data. This may therefore call any ERC20 token, and gauge or the VoterEscrow account and withdraw protocol funds.
The functions withdraw() and withdrawAll() can also be abused to take all funds deposited in the gauges and transfer them to the owners malicious address.
This poses a significant centralisation risk if the owner private key is compromised or the owner decides to rug pull.
After the owner has updated the operator via setOperator() they are able to call VoterProxy.execute() to execute any call to any smart contract.
Similarly, for withdraw() and withdrawAll()
This issue may be mitigated removing the ability for the owner to change the operator in VoterProxy.
If the functionality is require ensure it is behind a time lock and multisig / dao.
jetbrain10 (veToken Finance) acknowledged, but disagreed with severity and commented:
Alex the Entreprenerd (judge) commented:
