highLogic errorEVM-Solidity
Tapioca DAO: Absence of restrictions on the sender of the `twTAP.claimsReward()` function could enable attackers to freeze reward tokens within the Tap token contract
- Payout
- $0
- Protocol
- Tapioca DAO
- Disclosed
- May 23, 2024
- Source
- code4rena
Tapioca's twTAP.claimRewards() permits any caller to claim a position's reward so long as the chosen recipient is the position owner or an approved address. In the cross-chain claim flow, the owner must first approve the TapTokenReceiver contract and then rely …
Similar reports
- No close matches yet.
References
- https://github.com/code-423n4/2024-02-tapioca-findings/issues/142
- https://github.com/code-423n4/2024-02-tapioca-findings
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.