First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

SantasList:buyPresent() burns token of the gift recipient resulting in underflow as gift recipient has no SantaTokens

dougo

Summary

SantasList:buyPresent() burns token of the gift recipient resulting in underflow as gift recipient has no SantaTokens

Vulnerability Details

Incorrect specification of address whose santaTokens are to be burned results in underflow & breaks the intended use of the buyPresent() functionality

Impact

High overall (High impact, High likelihood)

PoC

The Foundry test below fails with the current code...

function testBuyPresentCorrected() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santaToken.approve(address(santasList), 1e18);
santasList.collectPresent();
santasList.buyPresent(recipient);
assertEq(santasList.balanceOf(user), 1);
assertEq(santasList.balanceOf(recipient), 1);
assertEq(santaToken.balanceOf(user), 0);
vm.stopPrank();
}

Tools Used

Visual Studio Code, Foundry

Recommendations

Change the address whose tokens are to be burned from presentReceiver to msg.sender as shown below...

function buyPresent(address presentReceiver) external {
i_santaToken.burn(msg.sender);
_mintAndIncrement();
}

Note: The test provided above will still fail, since the _mintAndIncrement() function mints the NFT to msg.sender. Another finding regarding _mintAndIncrement() has been submitted, which will fix this issue and allow the above test to pass.

Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

buyPresent should use msg.sender

Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!