Submitted by Ruhum
In the redeem() function, the user can pass a token address. Thats the token they receive in return for the ibbtc they give back. Because of missing address checks the user can provide any possible ERC20 token here without the function reverting.
Although its not strictly specified in the code I expect that the user should only be able to redeem wBTC or renBTC tokens since they should also only be able to deposit those.
Zap.sol L216-L238
Manual Analysis
Verify that the passed token address is either wBTC or renbtc
tabshaikh (BadgerDAO) disagreed with severity:
GalloDaSballo (BadgerDAO) commented:
