Submitted by Lambda, also found by 0x29A, Chom, cryptphi, itsmeSTYJ, kenzo, kirk-baird, and sashiketh_
In redeem, it is checked that the allowance is larger than underlyingAmount, which is the return parameter (i.e., equal to 0 at that point). Therefore, this check is always true and there is no actual allowance check, allowing anyone to redeem for another user.
Change the underlyingAmount to principalAmount, which is the intended parameter.
sourabhmarathe (Illuminate) disputed and commented:
gzeoneth (judge) commented:
