Submitted by 0xRobocop, also found by klau5
The rewards earned from the DAOs POL are distributed among the team wallet, then part of the remaining rewards are burned and the rest are kept as DAOs balance.
The issue, is that is possible for the DAO to claim SALT rewards without sending the teams share to the team wallet and without burning the amount that should be burned.
The first step during the upkeep functionality is to perform the upkeep on the liquidizer contract.
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/Upkeep.sol#L107
During that, if the amount of USDS to be burned is greater than the current balance of the liquidizer contract, then the code will withdraw some POL from the usds/dai and usds/salt pools:
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/stable/Liquidizer.sol#L123-L124
When removing liquidity, the code will decrease the daos share and in doing so it will send to it some rewards proportional to the amount of shares decreased:
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/staking/StakingRewards.sol#L136-L137
It is important note that pool rewards do not necessary comes from the emitter, but they can be added by third party protocols via the addRewards function in the StakingRewards contract:
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/staking/StakingRewards.sol#L182
Two options:
Picodes (Judge) commented:
othernet-global (Salty.IO) acknowledged and commented:
Status: Mitigation confirmed. Full details in reports from t0x1c, zzebra83, and 0xpiken.
