Submitted by WatchPug
Delegation.sol#L39-L46
Delegation is a contract deployed dedicated to holding the ticket tokens for the delegator and they can then be delegate to a delegatee.
On the Delegation contract, there is a method named executeCalls() designed for Executes calls on behalf of this contract which allows arbitrary code execution for the owner.
However, we found that the owner of Delegation will always be TWABDelegator, and the TWABDelegator will only use Delegation.sol#executeCalls() to call one particular address: the ticket address, and for only two methods: transfer() and delegate().
Furthermore, even though in Delegation.sol#executeCalls(), calls[i].value is used, the function is not being marked as payable, that makes it hard for calls that requires eth payments.
Delegation.sol#L39-L46
While the ticket is being delegated through TWABDelegator, they wont be able to retrieve the tickets back until the lockUntil, without the ability to make arbitrary code execution, the delegator may miss some of the potential benefits as a holder of the ticket tokens, for example, an airdrop to all holders of the ticket tokens, or an NFT made mintable only for certain ticket holders.
Consider adding a new method on TWABDelegator:
And also, consider making Delegation.sol#executeCalls() a payable method.
PierrickGT (PoolTogether) acknowledged and commented:
0xleastwood (judge) decreased severity to Low and commented:
