mediumAccess controlEVM-Solidity
Smilee Finance: FeeManager `receiveFee` and `trackVaultFee` functions allow anyone to call it with user-provided dvp/vault address and add any arbitrary feeAmount to any address, breaking fees accounting and temporarily bricking DVP smart contract
- Payout
- $0
- Protocol
- Smilee Finance
- Disclosed
- Mar 6, 2024
- Source
- sherlock
Smilee Finance's FeeManager exposes two fee-accounting entry points — trackVaultFee and receiveFee — that lack any role or address authentication. Because the only validation is that msg.sender implements vault()/baseToken(), any attacker can deploy a fake con …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.