Submission Details
Severity:
`TokenFactory:: deployToken` uses symbol to map token address, Same symbol will override the previous value cause previous token funds stuck
Summary
same symbol token can cause loss of funds
Vulnerability Details
when deployToken function is called, it take string symbol as input, along with bytes memory contractByteCode. If same symbol is provided by owner, then mapping will override the previous token address to the same symbol.
Example - owner create token with TEST as symbol and token is created 0x123.
Then owner again create toekn with TEST as symbol and token is created 0x456.
Now if check mapping then TEST will point to 0x456
Impact
old token vault will non usable, causing loss of funds
Tools Used
Manual Review
Recommendations
Don't allow same symbol tokens.
Updates
Lead Judging Commences
0xnevi about 2 years ago
Submission Judgement Published Assigned finding tags:
deployToken: non-unique symbol for tokens
Rewards breakdown
nSLOC
99This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.