First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

The s_tokenToAddress mapping allows new tokens to overwrite original token deployments

oops0x7070

Summary

Any implementation relying on the getTokenAddressFromSymbol(...) function could be returned a wrong address as a result over overwriting the token address.

Vulnerability Details

Whenever the deployToken(...) function is called by the owner to create a new token, the token address is stored in the s_tokenToAddress mapping with the key being the token symbol. There are no checks preventing an overwrite to a previously initialized mapping key. This means that users relying on getTokenAddressFromSymbol(...) could unknowingly be returned the wrong address at any point.

Impact

Users could unknowingly be returned the wrong address for a given symbol as a result of re-initialization of the s_tokenToAddress mapping.

Test:

function test_ReregToken() public {
vm.startPrank(owner);
console2.log("Registering token: TEST");
address tokenAddress = tokenFactory.deployToken("TEST", type(L1Token).creationCode);
console2.log("First TEST address: ", tokenAddress);
console2.log("getTokenAddressFromSymbol('TEST') => " , tokenFactory.getTokenAddressFromSymbol("TEST"));
console2.log("Re-registering token: TEST");
address tokenAddress2 = tokenFactory.deployToken("TEST", type(L1Token).creationCode);
console2.log("Second TEST address: ", tokenAddress2);
console2.log("getTokenAddressFromSymbol('TEST') => " , tokenFactory.getTokenAddressFromSymbol("TEST"));
vm.stopPrank();
}

Result:

Logs:
Registering token: TEST
First TEST address: 0xf801f3A6F4e09F82D6008505C67a0A5b39842406
getTokenAddressFromSymbol('TEST') => 0xf801f3A6F4e09F82D6008505C67a0A5b39842406
Re-registering token: TEST
Second TEST address: 0x03701a3db17248c79AA6512CcDC89c45bc1443E2
getTokenAddressFromSymbol('TEST') => 0x03701a3db17248c79AA6512CcDC89c45bc1443E2

Tools Used

Manual review
Foundry

Recommendations

add the following to the top of the deployToken(...) function:
require(s_tokenToAddress[symbol] == address(0), "Symbol already registered.");

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

deployToken: non-unique symbol for tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.