Submitted by 0xpiken
The Development Team could potentially incur a loss on their SALT distribution reward due to the absence of access control on VestingWallet#release().
When Salty exchange is actived, 10M SALT will be transferred to teamVestingWallet by calling InitialDistribution#distributionApproved():
teamVestingWallet is responsible for distributing 10M SALT linely over 10 years (Deployment.sol#L100):
From the above code we can see that the beneficiary of teamVestingWallet is Upkeep.
Each time Upkeep#performUpkeep() is called, teamVestingWallet will release a certain amount of SALT to Upkeep, the beneficiary, and then the relased SALT will be transferred to mainWallet of managedTeamWallet:
However, there is no access control on teamVestingWallet.release(). Any one can call release() to distribute SALT without informing upkeep. upkeep doesnt know how many SALT has been distributed in advance, it has no way to transfer it to the development team, and the distributed SALT by directly calling teamVestingWallet.release() will be locked in upkeep forever.
Copy below codes to DAO.t.sol and run COVERAGE="yes" NETWORK="sep" forge test -vv --rpc-url RPC_URL --match-test testTeamRewardIsLockedInUpkeep
othernet-global (Salty.IO) confirmed and commented:
Picodes (Judge) commented:
Note: For full discussion, see here.
Status: Mitigation confirmed. Full details in reports from 0xpiken, zzebra83, and t0x1c.
