Submitted by GimelSec, also found by GalloDaSballo, kebabsec, and kenzo
VoteEscrowDelegation._transferFrom should be successfully executed if msg.sender is the current owner, an authorized operator, or the approved address. removeDelegation is called in _transferFrom. removeDelegation only accepts the token owner. Thus, _transferFrom can only be executed by the token owner.
removeDelegation is called in _transferFrom
https://github.com/code-423n4/2022-07-golom/blob/main/contracts/vote-escrow/VoteEscrowDelegation.sol#L242
However, removeDelegation only accept the token owner
https://github.com/code-423n4/2022-07-golom/blob/main/contracts/vote-escrow/VoteEscrowDelegation.sol#L211
Fix the permission control in removeDelegation.
zeroexdead (Golom) confirmed
zeroexdead (Golom) commented:
0xsaruman (Golom) resolved
