First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

```TokenFactory::deployToken()``` allows overwriting of addresses in Token Address Mapping

kiteweb3

Summary

The TokenFactory contract maintains a mapping of token symbols to their corresponding contract addresses. This allows anyone to retrieve the address of a token given its symbol. However, the current implementation of TokenFactory::deployToken() does not prevent the overwriting of addresses if two tokens with the same symbol are deployed.

Vulnerability Details

​
@> mapping(string tokenSymbol => address tokenAddress) private s_tokenToAddress;
​
function deployToken(string memory symbol, bytes memory contractBytecode) public onlyOwner returns (address addr) {
assembly {
addr := create(0, add(contractBytecode, 0x20), mload(contractBytecode))
}
@> s_tokenToAddress[symbol] = addr;
emit TokenDeployed(symbol, addr);
}

Impact

If two tokens with the same symbol are deployed, the address of the second token will overwrite the address of the first token in the mapping. This could lead to confusion and potential loss of access to the first token. If the first token address is used in the L1BossBridge contract the user could lose the access to his/her funds.

//The Tokens with the same symbol are overwritten
​
function testCanOverrideToken() public {
vm.prank(owner);
address tokenAddress_1 = tokenFactory.deployToken("TEST", type(L1Token).creationCode);
assertEq(tokenFactory.getTokenAddressFromSymbol("TEST"), tokenAddress_1);
​
//The "TEST" token address at the first deploy
console2.log("The TEST token address at the first deploy is:", tokenFactory.getTokenAddressFromSymbol("TEST"));
​
vm.prank(owner);
address tokenAddress_2 = tokenFactory.deployToken("TEST", type(L1Token).creationCode);
assertEq(tokenFactory.getTokenAddressFromSymbol("TEST"), tokenAddress_2);
​
//The "TEST" token address at the second deploy
console2.log("The TEST token address at the second deploy is:", tokenFactory.getTokenAddressFromSymbol("TEST"));
}
Logs:
The TEST token address at the first deploy is: 0xf801f3A6F4e09F82D6008505C67a0A5b39842406
The TEST token address at the second deploy is: 0x03701a3db17248c79AA6512CcDC89c45bc1443E2

Tools Used

Manual Review

Recommendations

Add a condition in the deployToken() function to revert if a token with the same symbol already exists.

Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

deployToken: non-unique symbol for tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.