can withdraw shares on behalf of anyone

[code423n4]

Handle

cmichel

Vulnerability details

The BasicSale.withdrawShareForMember function allows withdrawing the shares of other users.
While the tokens are sent to the correct address, this can lead to issues with smart contracts that might rely on claiming the tokens themselves.

As an example, suppose the member address corresponds to a smart contract that has a function of the following form:

function claimAndDoSomething() {
    uint256 claimedAmount = mainToken.balanceOf(address(this));
    contract.withdrawShare();
    claimedAmount = mainToken.balanceOf(address(this)) - claimedAmount;
    mainToken.transfer(externalWallet, claimedAmount);
}

Impact

If the contract has no other functions to transfer out funds, they may be locked forever in this contract.

Recommended Mitigation Steps

Do not allow users to withdraw on behalf of other users.

[chickenpie347]

This function is not intended to be used by smart contracts, and if indeed smart contracts are created to be used, I am sure they would follow the intricacies needed.

[0xean]

I am not clear on what the benefit of allowing someone to withdraw on behalf of someone else actually is here. Will leave the issue as low risk