supplyTokenTo allows users to bypass prize pool

[code423n4]

Lines of code

https://github.com/pooltogether/aave-v3-yield-source/blob/e63d1b0e396a5bce89f093630c282ca1c6627e44/contracts/AaveV3YieldSource.sol#L231-L242

Vulnerability details

Impact

Loss of user rewards

Proof of Concept

Contract allows anyone to call the supplyTokenTo and redeemToken functions, allowing users to bypass prize pool contract and deposit/supply directly to the Yield Source. Underlying tokens would be safe but user's rewards would be distributed to other users or lost

Tools Used

Recommended Mitigation Steps

Require that only prize pool can make redeem or supply calls

[PierrickGT]

A user depositing into the yield source by calling the supplyTokenTo function would receive ERC20 tokens representing his shares of the deposit. He would then be later able to withdraw by calling the redeemToken functions and he would receive back his principal that he deposited earlier.
As mentioned by the warden, his deposit would be safe since he can withdraw at any time. Interest generated by this yield source is indeed redistributed to people that have deposited in a PoolTogether prize pool that uses this yield source and who win draws.
This is an intended behavior that allows any PoolTogether prize pool to use this contract as yield source. It wouldn't make sense to restrict the usage only to whitelisted prize pools.
For the reasons above, I've disputed the issue.

[gititGoro]

The only way this would be an issue is if a UI directed users inappropriately but that's beyond the scope of this contest. Marking invalid.