First Flight #4: Boss Bridge
First Flight #4
Beginner FriendlyFoundryBridge
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

no check for existing token in TokenFactory deployToken function - all relative assets loss if token already exists

C0D30

Summary

Adding token with the symbol that already exists will overwrite the address of the existing one, which leads to all token's assets loss

Vulnerability Details

Before adding a new token, the function should check if a token with the same symbol exists, otherwise it will overwrite the address of existing token leading to all token assets loss for everyone.

Impact

Foundry test

  • deploying a token

  • sending 1 ether tokens to Alice

  • deploying another token with the same symbol

  • assigning it to the previous token variable

  • checking Alice balance to be 1 ether

  • TEST FAILS - Alice has 0 balance

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.20;
​
import { Test } from "forge-std/Test.sol";
import { TokenFactory } from "../src/scope/TokenFactory.sol";
import { L1Token } from "../src/scope/L1Token.sol";
​
contract TokenFactoryTest is Test {
TokenFactory tokenFactory;
address owner = makeAddr("owner");
address alice = makeAddr("Alice");
L1Token theToken;
​
function setUp() public {
vm.prank(owner);
tokenFactory = new TokenFactory();
}
​
function testAddToken() public {
vm.prank(owner);
address tokenAddress = tokenFactory.deployToken("Test", type(L1Token).creationCode);
theToken = L1Token(tokenAddress);
​
vm.prank(address(tokenFactory));
theToken.transfer(alice, 1e18);
​
vm.prank(owner);
address tokenAddress2 = tokenFactory.deployToken("Test", type(L1Token).creationCode);
theToken = L1Token(tokenAddress2);
​
// TEST FAILS - ALice has 0 balance
assertEq(theToken.balanceOf(alice), 1e18);
}
}
​

Recommendations

add check for existing symbol in the mapping

function deployToken(string memory symbol, bytes memory contractBytecode) public onlyOwner returns (address addr) {
+ require(s_tokenToAddress[symbol] == address(0), "Token exists");
assembly {
addr := create(0, add(contractBytecode, 0x20), mload(contractBytecode))
}
s_tokenToAddress[symbol] = addr;
emit TokenDeployed(symbol, addr);
}
Updates

Lead Judging Commences

0xnevi Lead Judge
almost 2 years ago
0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

deployToken: non-unique symbol for tokens

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.