Submitted by IllIllI, also found by GimelSec
A malicious owner or manager can steal all Aave rewards that are meant for PoolTogether users.
Even if the user is benevolent the fact that there is a rug vector available may negatively impact the protocols reputation.
AaveV3YieldSource.sol#L275-L282
The claimRewards() function allows the caller to send the rewards to an arbitrary address.
Use a poolAddressesProviderRegistry-like contract to determine where the rewards should go, instead of letting an address be passed in
PierrickGT (PoolTogether) acknowledged and commented:
