First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

No check of existing symbol in TokenFactory

n0kto

Summary

The deployToken function in the provided code does not check if a symbol already exists before assigning a new address to it. This allows a malicious/absent-minded owner to replace the address associated with a symbol.

Vulnerability Details

The deployToken function is called to create a new token with a given symbol and bytecode. However, the function does not perform any validation to ensure that the symbol is unique. As a result, a malicious owner can call the deployToken function multiple times with the same symbol and different bytecode, effectively replacing the address associated with the symbol.

Foundry PoC (in test file) :

function testOverrideTokenAddress() public {
// create a first token
vm.prank(owner);
address tokenAddress = tokenFactory.deployToken(
"TEST",
type(L1Token).creationCode
);
assertEq(tokenFactory.getTokenAddressFromSymbol("TEST"), tokenAddress);
​
// use the same symbol but with another address
vm.prank(owner);
address newTokenAddress = tokenFactory.deployToken(
"TEST",
type(L1Token).creationCode
);
​
// check that new address is not the same than the old one
assertFalse(newTokenAddress == tokenAddress);
​
// check that new address replaced the previous one.
assertEq(
tokenFactory.getTokenAddressFromSymbol("TEST"),
newTokenAddress
);
}

Impact

This vulnerability allows a malicious/absent-minded owner to override the address associated with a token symbol. This can have various consequences, such as:

  • Changing the behavior of existing contract interacting with the TokenFactory to find contract address.

  • Confusing users and causing financial losses.

  • Cannot put again in the mapping the replaced contract.

Tools Used

Manual review

Recommendations

To mitigate this vulnerability, the deployToken function should include a check to ensure that the symbol does not already exist before assigning a new address to it. Example : require(s_tokenToAddress[symbol] == address(0))

Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

deployToken: non-unique symbol for tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.