Submitted by p4st13r4, also found by GimelSec, TrungOre, and VAD37
https://github.com/code-423n4/2022-05-cally/blob/main/contracts/src/Cally.sol#L193
https://github.com/code-423n4/2022-05-cally/blob/main/contracts/src/Cally.sol#L199
Affected code:
Currently its possible to create an ERC-721 vault using Cally own address as token, and using the freshly minted vault id as tokenIdOrAmount. This results in a new vault whose ownership is passed to Cally contract immediately upon creation.
The vault allows users to perform buyOption and increase the ETH balance of the Cally contract itself, which is still the vault beneficiary. As soon as an user calls exercise, she will receive the vault.tokenIdOrAmount in exchange, which in this case coincides with the vault nft. However this is of no good because the final user may just initiate a withdrawal, which will:
So the vault will be unusable and the ETH deposited by users to buy/exercise options will remain locked in Cally contract
Add the following check at the start of createVault():
outdoteth (Cally) confirmed, disagreed with severity and commented:
outdoteth (Cally) resolved:
HardlyDifficult (judge) decreased severity to Medium and commented:
