Skip to content
Request an audit

‹ Findings database

Anyone can deposit to DarkpoolAssetManager as the owner can be freely chosen without any implication

Crit/HighSingularity audit·Three Sigma·Private DeFi access·26th February, 20243S-SG-H06

Description

DarkpoolAssetManager::depositETH() and DarkpoolAssetManager::depositERC20() allow choosing any owner, while the msg.sender still receives the deposit.

Recommendation

The owner should be the msg.sender or the owner's signature should be validated (so it can be relayed).

Status

Addressed in #8b300f0.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests