RewardsController Emission Manager Can Authorize Users to Claim on Behalf of the AaveV3YieldSource Contract and Siphon Yield

[code423n4]

Lines of code

https://github.com/aave/aave-v3-periphery/blob/master/contracts/rewards/RewardsController.sol#L190-L193
https://github.com/aave/aave-v3-periphery/blob/master/contracts/rewards/RewardsController.sol#L39-L42
https://github.com/aave/aave-v3-periphery/blob/master/contracts/rewards/RewardsController.sol#L133-L143
https://github.com/pooltogether/aave-v3-yield-source/blob/e63d1b0e396a5bce89f093630c282ca1c6627e44/contracts/AaveV3YieldSource.sol#L275-L286

Vulnerability details

Impact

The AaveV3YieldSource contract allows the manager or owner of the contract to claim rewards from Aave's rewards controller. However, there is an external dependency on this periphery Aave contract such that the emission manager of the RewardsController contract may allows other users to be authorized claimers.

Authorized claimers can claim rewards on behalf of the AaveV3YieldSource contract, effectively bypassing any restrictions put in place by this proprietary contract and its claimRewards() function. A malicious emissions manager can effectively siphon yield away from the AaveV3YieldSource contract and redirect it to them-self.

Tools Used

• Manual code review.

Recommended Mitigation Steps

Ensure this is understood and enforce that the RewardsController contract is owner by PoolTogether's multisig.

[PierrickGT]

Exactly, we will need to whitelist an address by calling the setClaimer function: https://github.com/aave/aave-v3-periphery/blob/ca184e5278bcbc10d28c3dbbc604041d7cfac50b/contracts/rewards/RewardsController.sol#L190
We will probably setup a contract that can claim for various yield sources.