Submitted by GalloDaSballo
Project.sol#L770
autoWithdraw will send funds to the builder, we can use this knowledge to drain all funds from Project to the builder contract. Completely sidestepping the whole Task based logic.
Through creation and deletion of tasks, leveraging autoWithdraw which will always send the funds to be builder, even when origin was the Community, a builder can cycle out all funds out of the Project Contract and transfer them to themselves.
Ultimately this breaks the trust assumptions and guarantees of the Task System, as the builder can now act as they please, the Project contract no longer holding any funds is limited.
Only aspect that diminishes impact is that the system is based on Credit (uncollateralized /undercollateralized lending), meaning the Builder wouldnt be committing a crime in taking ownership of all funds.
However the system invariants used to offer completely transparent accounting are now bypassed in favour of trusting the builder.
We know we can trigger autoWithdraw it by creating and allocating a task, and then reducing its cost
To funnel the funds we can:
Repeat until all funds are funneled into the builder wallet.
The reason why the builder can do this is because in all functions involved:
only the builder signature is necessary, meaning the contract is fully trusting the builder
Below are listed two options for mitigation
parv3213 (Rigor) acknowledged and commented:
Jack the Pug (judge) decreased severity to Medium and commented:
