Vether.sol implements a fee on every token transfer, unless either the sender or the recipient exists on a list of excluded addresses (mapAddress_Excluded). However, the addExcluded() function in Vether.sol has no restrictions on who can call it.
So any user can call addExcluded with their own address as the argument, and bypass all transfer fees.
Alice calls:
(1) Vether.addExcluded(aliceAddress), which adds Alices address to mapAddress_Excluded.
(2) Alice can now freely transfer Vether with no fees.
Recommend adding restrictions to who can call addExcluded, perhaps by restricting it to a caller set by DAO.sol
strictly-scarce (vader) commented:
dmvt (judge) commented:
moneylegobatman (C4 Editor) commented:
