cu5t0mPe0 - execute_create_batch will not work properly

[sherlock-admin2]

cu5t0mPe0

Medium

execute_create_batch will not work properly

Summary

Since the recipient will not be the owner, execute_create_batch will not be usable.

Vulnerability Detail

execute_create_batch can only be called by the owner, and when validator_to_delegate_to is set, execute_create_batch will call execute_delegate.

https://github.com/sherlock-audit/2024-05-andromeda-ado/blob/bbbf73e5d1e4092ab42ce1f827e33759308d3786/andromeda-core/contracts/finance/andromeda-vesting/src/contract.rs#L126-L129

https://github.com/sherlock-audit/2024-05-andromeda-ado/blob/bbbf73e5d1e4092ab42ce1f827e33759308d3786/andromeda-core/contracts/finance/andromeda-vesting/src/contract.rs#L189

But the Sherlock docs mention: For the vesting contract, the current recipient is the owner, but this is likely to be changed to a recipient address, and the delegation methods would be restricted to the recipient rather than the owner.

So the situation is: execute_create_batch can only be called by the owner, while execute_delegate can only be called by the recipient.

Therefore, when the execute_create_batch is set to be called only by the recipient in the future, execute_create_batch will not function properly.(note: recipient is a state variable, not a parameter)

This issue exists in both the current Sherlock version and the latest official repo.

Impact

execute_create_batch does not work properly

Code Snippet

https://github.com/sherlock-audit/2024-05-andromeda-ado/blob/bbbf73e5d1e4092ab42ce1f827e33759308d3786/andromeda-core/contracts/finance/andromeda-vesting/src/contract.rs#L126-L129

https://github.com/sherlock-audit/2024-05-andromeda-ado/blob/bbbf73e5d1e4092ab42ce1f827e33759308d3786/andromeda-core/contracts/finance/andromeda-vesting/src/contract.rs#L189

Tool used

Manual Review

Recommendation

Inline the current execute_delegate logic in execute_create_batch or allow both the owner and the recipient to call the execute_delegate

Duplicate of #59