First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

SantasList:buyPresent() burns token of the gift recipient resulting in underflow as gift recipient has no SantaTokens

dougo

Summary

SantasList:buyPresent() burns token of the gift recipient resulting in underflow as gift recipient has no SantaTokens

Vulnerability Details

Incorrect specification of address whose santaTokens are to be burned results in underflow & breaks the intended use of the buyPresent() functionality

Impact

High overall (High impact, High likelihood)

PoC

The Foundry test below fails with the current code...

function testBuyPresentCorrected() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santaToken.approve(address(santasList), 1e18);
santasList.collectPresent();
santasList.buyPresent(recipient);
assertEq(santasList.balanceOf(user), 1);
assertEq(santasList.balanceOf(recipient), 1);
assertEq(santaToken.balanceOf(user), 0);
vm.stopPrank();
}

Tools Used

Visual Studio Code, Foundry

Recommendations

Change the address whose tokens are to be burned from presentReceiver to msg.sender as shown below...

function buyPresent(address presentReceiver) external {
i_santaToken.burn(msg.sender);
_mintAndIncrement();
}

Note: The test provided above will still fail, since the _mintAndIncrement() function mints the NFT to msg.sender. Another finding regarding _mintAndIncrement() has been submitted, which will fix this issue and allow the above test to pass.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

buyPresent should use msg.sender

Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.