highAccess controlEVM-Solidity
Salty.IO: Development Team might receive less SALT because there is no access control on `VestingWallet#release()`
- Payout
- $0
- Protocol
- Salty.IO
- Disclosed
- Apr 19, 2024
- Source
- code4rena
The Salty.IO protocol design incorrectly relied on the Upkeep contract as the sole beneficiary and processor for team token vesting rewards. Because the underlying vesting wallet's release mechanism was publicly callable, an external party could trigger the re …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-01-salty-findings/issues/712
- https://github.com/code-423n4/2024-01-salty-findings
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.