Submitted by ladboy233, also found by yixxas, JTJabba, rbserver, Aymen0909, horsefacts, minhtrng, 0xhunter, Trust, peritoflores, 0xDecorativePineapple, Dravee, hansfriese, imare, Jeiwan, wagmi, 0x52, Picodes, cryptonue, pashov, Bnke0x0, Lambda, Nyx, cccz, dic0de, csanuragjain, and rvierdiiev
The function recoverERC20 is very privileged. It means to recover any token that is accidently sent to the contract.
However, admin / owner can use this function to transfer all the reserved reward tokens, which result in fund loss of the pledge creator and the loss of reward for users that want to delegate the veToken.
Also, the recovered token is sent to owner directly instead of sending to a recipient address.
The safeguard
cannot stop owner transferring funds because if the owner is compromised or misbehaves, he can adjust the whitelist easily.
The admin can set minAmountRewardToken[token] to 0 first by calling updateRewardToken:
By doing this the admin removes the token from the whitelist, then the token can call recoverERC20 to transfer all the token into the owner wallet.
We recommend that the project uses a multisig wallet to safeguard the owners wallet.
We can also keep track of the reserved amount for rewarding token and only transfer the remaining amount of token out.
Then we can change the implementation to:
Kogaroshi (Paladin) confirmed
Kogaroshi (Paladin) commented:
