Submitted by sashik_eth, also found by said
PosManager#removeCollateralWLpTo function allows users to remove collateral wrapped in a wLp token that was previously supplied to the protocol:
This function could be called only from the core contract using the decollateralizeWLp and liquidateWLp functions. However, it fails to check if the specified tokenId belongs to the current position, this check would take place only if removing is full - meaning no lp tokens remain wrapped in the wLp (line 257).
This would allow anyone to drain any other positions with supplied wLp tokens. The attacker only needs to create its own position, supply dust amount in wLp to it, and call decollateralizeWLp with the desired tokenId, also withdrawn amount should be less than the full wLp balance to prevent check on line 257. An attacker would receive almost all lp tokens and accrued rewards from the victims wLp.
A similar attack for harvesting the victims rewards could be done through the liquidateWLp function.
Attacker could drain any wLp token and harvest all accrued rewards for this token.
The next test added to the tests/wrapper/TestWLp.sol file could show an exploit scenario:
Consider adding a check that position holds the specified token into the removeCollateralWLpTo function:
fez-init (INIT) confirmed
