Skip to content
Request an audit

‹ All findings

Anyone can deposit to DarkpoolAssetManager as the owner can be freely chosen without any implication

Crit/HighSingularity·Three Sigma · Private DeFi access · 26th February, 20243S-SG-H06

ReportSource

Description

DarkpoolAssetManager::depositETH() and DarkpoolAssetManager::depositERC20() allow choosing any owner, while the msg.sender still receives the deposit.

Recommendation

The owner should be the msg.sender or the owner's signature should be validated (so it can be relayed).

Status

Addressed in #8b300f0.