Submitted by rvierdiiev, also found by xuwinnie
Functions depositWithPermit and mintWithPermit are allowed to be called by the permit creator only. Not any other contracts will be able to execute these function on behalf of signer.
The depositWithPermit function is allowed to provide a signed permit in order to receive, approve and deposit funds into the vault.
https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L427-L437
This function calls _permit and pass msg.sender as _owner to that function.
https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L1093-L1104
This means, that the signer can be only the same person that called depositWithPermit function.
However, the purpose of the permit is to allow someone to sign the approve signature, so that this signature can be used by another contract to call some function on behalf of signer.
In this case, anyone should be able to sign permit for the vault, and vault should check that _receiver is same who signed permit.
VsCode
Use _receiver instead of msg.sender.
Error
asselstine (PoolTogether) confirmed
PoolTogether mitigated:
Status: Mitigation confirmed. Full details in report from dirk_y, rvierdiiev and 0xStalin.
