getReward incorrectly sets msg.sender as receiver instead of owner.

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2024-10-ramses-exchange/blob/236e9e9e0cf452828ab82620b6c36c1e6c7bb441/contracts/CL/gauge/GaugeV3.sol#L452

Vulnerability details

Proof of Concept

getReward calls _getAllRewards passing in msg.sender as recevier. Since, not only the owner can call the function for a tokenId, the rewards are incorrectly sent to the caller instead of the owner which is a security breach. In cases where the interactions are done through a contract, the rewards might be lost in the contract instead.

    function getReward(uint256 tokenId, address[] memory tokens) public lock {
// ...
        _getAllRewards(
            address(_nfpManager),
            tokenId,
            tickLower,
            tickUpper,
            tokens,
            msg.sender
        );
    }

Recommended Mitigation Steps

Send the rewards to the token owner instead.

        _getAllRewards(
            address(_nfpManager),
            tokenId,
            tickLower,
            tickUpper,
            tokens,
-           msg.sender
+           owner
        );
    }

Assessed type

Context