Non-existing recipient will return true on call

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/085f573756b132b2a5992c5aa5d7b907cd11c289//convex-platform/contracts/contracts/BoosterOwner.sol#L187
https://github.com/code-423n4/2022-05-aura/blob/085f573756b132b2a5992c5aa5d7b907cd11c289//convex-platform/contracts/contracts/StashFactoryV2.sol#L89
https://github.com/code-423n4/2022-05-aura/blob/085f573756b132b2a5992c5aa5d7b907cd11c289//convex-platform/contracts/contracts/StashFactoryV2.sol#L95
https://github.com/code-423n4/2022-05-aura/blob/085f573756b132b2a5992c5aa5d7b907cd11c289//convex-platform/contracts/contracts/StashFactoryV2.sol#L101
https://github.com/code-423n4/2022-05-aura/blob/085f573756b132b2a5992c5aa5d7b907cd11c289//convex-platform/contracts/contracts/VoterProxy.sol#L352

Vulnerability details

Impact

Consider checking the recipient address for existence before making the call.
If the address does not exist, call will return true and the user will not get the tokens to his wallet.

Proof of Concept

https://docs.soliditylang.org/en/develop/control-structures.html#:~:text=Warning-,The%20low%2Dlevel%20functions,-call%2C%20delegatecall

Tools Used

Recommended Mitigation Steps

---

[phijfry]

• For the stash factories there are upstream checks that ensure the _gauge is indeed a gauge contract.
• The VoterProxy is just an external execute function
• The BoosterOwner is just an external execute function

[0xMaharishi]

Valid but given the reasons listed by fry, should be a 1 severity at most

[dmvt]

Agree with sponsor. Downgrading to QA. While the report is technically accurate, the functions in question are all guarded ensuring that only privileged users who theoretically know what they're doing are calling them.

[dmvt]

Grouping this with the warden’s QA report, #17