Submitted by leastwood
aave/RewardsController.sol#L190-L193
aave/RewardsController.sol#L39-L42
aave/RewardsController.sol#L133-L143
AaveV3YieldSource.sol#L275-L286
The AaveV3YieldSource contract allows the manager or owner of the contract to claim rewards from  Aaves rewards controller. However, there is an external dependency on this periphery Aave contract such that the emission manager of the RewardsController contract may allows other users to be authorized claimers.
Authorized claimers can claim rewards on behalf of the AaveV3YieldSource contract, effectively bypassing any restrictions put in place by this proprietary contract and its claimRewards() function. A malicious emissions manager can effectively siphon yield away from the AaveV3YieldSource contract and redirect it to them-self.
Ensure this is understood and enforce that the RewardsController contract is owner by PoolTogethers multisig.
PierrickGT (PoolTogether) acknowledged and commented:
