Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

The owner might inadvertently provide the proxy address of a different salt.

0x4ka5h

Summary

Vulnerability Details

Vulnerable code:

function distributeByOwner(
...
) public onlyOwner {
...
bytes32 salt = _calculateSalt(organizer, contestId, implementation);
if (saltToCloseTime[salt] == 0) revert ProxyFactory__ContestIsNotRegistered();
if (saltToCloseTime[salt] + EXPIRATION_TIME > block.timestamp) revert ProxyFactory__ContestIsNotExpired();
_distribute(proxy, data);
}

Patch:

function distributeByOwner(
...
) public onlyOwner {
...
bytes32 salt = _calculateSalt(organizer, contestId, implementation);
// Check if the provided proxy address matches the expected proxy address derived from the salt
require(proxy != getProxyAddress(salt, implementation), "salt not matched with input proxy");
​
...
_distribute(proxy, data);
}

The vulnerability stems from the absence of validation in the original code regarding whether the provided proxy address aligns with the expected salt and implementation. This deficiency opens the door for the owner to inadvertently supply a proxy address that does not correspond to the calculated salt and implementation. Consequently, there exists a risk wherein the distribution process could operate on a proxy unintended for the current operation. This situation could lead to unintended outcomes, such as erroneous token transfers or other actions not intended by the owner.

Impact

mistakenly passed proxy address might not necessarily be expired according to the logic of the saltToCloseTime mapping. This introduces the potential for a loss of funds if the mistakenly provided proxy address is still active and accessible.

Also, the expired contest also can passed, with the income.
Severity: Medium

Impact: HIGH

LikelyHood: Low

Tools Used

Recommendations

The function should call the getProxyAddress function for cross check.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!