Private vault owners cannot withdraw

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-astaria/blob/main/src/Vault.sol#L72

Vulnerability details

Impact

SafeTransferFrom requires approval, so it's not possible for the vault owner to withdraw from his private vault.

Proof of Concept

pragma solidity =0.8.17;

import "forge-std/Test.sol";

import {Authority} from "solmate/auth/Auth.sol";
import {FixedPointMathLib} from "solmate/utils/FixedPointMathLib.sol";
import {MockERC721} from "solmate/test/utils/mocks/MockERC721.sol";
import {
  MultiRolesAuthority
} from "solmate/auth/authorities/MultiRolesAuthority.sol";

import {ERC721} from "gpl/ERC721.sol";
import {SafeCastLib} from "gpl/utils/SafeCastLib.sol";

import {IAstariaRouter, AstariaRouter} from "../AstariaRouter.sol";
import {VaultImplementation} from "../VaultImplementation.sol";
import {PublicVault} from "../PublicVault.sol";
import {TransferProxy} from "../TransferProxy.sol";
import {WithdrawProxy} from "../WithdrawProxy.sol";
import {Vault} from "../Vault.sol";

import {Strings2} from "./utils/Strings2.sol";

import "./TestHelpers.t.sol";
import {OrderParameters} from "seaport/lib/ConsiderationStructs.sol";

contract AstariaTest is TestHelpers {
  using FixedPointMathLib for uint256;
  using CollateralLookup for address;
  using SafeCastLib for uint256;

  event NonceUpdated(uint256 nonce);
  event VaultShutdown();

  function testCantWithdraw() public {

    address privateVault = _createPrivateVault({
      strategist: address(this),
      delegate: address(0)
    });

    vm.deal(address(this), 50 ether);
    WETH9.deposit{value: 50 ether}();
    WETH9.approve(privateVault, 50 ether);
    Vault(privateVault).deposit(50 ether, address(this));
    vm.expectRevert();
    Vault(privateVault).withdraw(10 ether);
    
  }
}

Tools Used

VSCode, Foundry

Recommended Mitigation Steps

Use safeTransfer instead.

[c4-judge]

Picodes marked the issue as duplicate of #489

[c4-judge]

Picodes marked the issue as satisfactory