First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

`TokenFactory::deployToken` can create multiple token with same `symbol`

0xaraj

Summary

TokenFactory::deployToken is creating new token by taking token symbol and token contractByteCode as argument, owner can create multiple token with same symbol by mistake

Vulnerability Details

deployToken is not checking weather that token exists or not.

How it will work

  1. Owner created a token with symbol TEST and it will store tokenAddress in s_tokenToAddress mapping

  2. Again owner created a token with symbol TEST and this will replace the previous tokenAddress with symbol TEST

Here is the PoC

// SPDX-License-Identifier: MIT
pragma solidity 0.8.20;
​
import { Test, console2 } from "forge-std/Test.sol";
import { TokenFactory } from "../src/TokenFactory.sol";
import { L1Token } from "../src/L1Token.sol";
​
contract TokenFactoryTest is Test {
TokenFactory tokenFactory;
address owner = makeAddr("owner");
​
function setUp() public {
vm.prank(owner);
tokenFactory = new TokenFactory();
}
​
function test_can_create_duplicate_tokens() public {
vm.startPrank(owner);
address tokenAddress = tokenFactory.deployToken("TEST", type(L1Token).creationCode);
address duplicate = tokenFactory.deployToken("TEST", type(L1Token).creationCode);
// here you can see tokenAddress is the duplicate one
assertEq(tokenFactory.getTokenAddressFromSymbol("TEST"), duplicate);
}
}

To run test

forge test --mt test_can_create_duplicate_tokens -vvv

Impact

If that token is being used in validation then all the token holders will lose funds

Tools Used

Manual review

Recommendations

Use checks to see, if that token exists in TokenFactory::deployToken

+ if (s_tokenToAddress[symbol] != address(0)) {
+ revert TokenFactory_AlreadyExist();
+ }
Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

deployToken: non-unique symbol for tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.