Rebalance manager can steal tokens

[code423n4]

Handle

cmichel

Vulnerability details

The rebalance manager can perform trades on the entire basket amount and steal tokens this way, for example, by adding their own contract as the exchange through setExchange, followed by approving tokens to this contract through the RebalanceManagerV2.rebalance action.

Impact

The rebalance manager of each basket needs to be trusted.

Recommended Mitigation Steps

Document that the rebalance manager needs to be trusted as well, the current docs talk about an owner but it was not clear to me that the rebalance manager is always assumed to be the owner of a basket.

• RebalanceMangers - Enable trading the baskets underlying token to rebalance the index constitution (only owner).

[loki-sama]

This is intended behavior

[0xleastwood]

I think the warden has outlined missing documentation related to the trusted setup of the rebalance manager. As such, I'll mark this as low considering this is intended behaviour.