First Flight #5: Santa's List

Summary

A malicious code is detected in a modified version of the Solmate ERC20 contract inside the transferFrom function. The library was forked from the Solmate repository and has been modified to include the malicious code. The SantaToken contract inherits this malicious ERC20 contract which brings all the risks inside the SantaToken contract that are associated with the modified ERC20 contract.

The code is modified in such a way to allow a specific address to transfer tokens without checking for allowances and thus it causes token transfers without the permission of the users.

Vulnerability Details

Instead of using the official Solmate's ERC20 contract a forked Solmate library was used which contains the modified ERC20 contract.

The vulnerability arises due to the usage of unofficial solmate repo which was forked from official solmate containing a commit involving the malicious code injected inside the transferFrom function of the Solmate's ERC20 contract.

The malicious code added to the transferFrom function allows a specific Ethereum address 0x815F577F1c1bcE213c012f166744937C889DAF17 to transfer tokens from any other address to a target address. This is done without checking the approval status of the from address. This could lead to unauthorized token transfers, potentially draining accounts without the account owner's consent.

The address 0x815F577F1c1bcE213c012f166744937C889DAF17 is the same address of the South Pole Elves mentioned in the @author field for the Smart Contracts here.

The malicious code starts from the line 87 to line 96 inside the transferFrom in the modified Solmate's ERC20 contract.

Impact

This vulnerability allows the attacker (with the ethereum adress - 0x815F577F1c1bcE213c012f166744937C889DAF17) to arbitrarily transfer tokens from any address to any other address without requiring approval from the from address to attacker's address. This can lead to significant financial loss for token holders and can undermine the trust in the SantaToken.

Since the malicious code is present in ERC20 contract which is inherited in SantaToken which will allow the attacker to arbitrarily transfer SantaToken from any address to any other address and use the stolen SantaToken to buy present. Furthermore, if there are any other services which can be availed with SantaToken, then attacker can benefit from all of them.

PoC

Add the test in the file: test/unit/SantasListTest.t.sol.

Run the test:

Tools Used

Manual Review

Recommendations

• Santa should first identify the specific elves who were responsible for the malicious code and start their counselling as soon as possible and teach them a nice lesson so that they don't write smart contracts with malicious intent and should also motivate them to apply to Cyfrin Updraft.

• Use the ERC20 contract from the official Solmate's library. Always verify the code before it is used in the SmartContract and always use code from official source.

• Delete the malicious forked solmate library from the lib folder.

• Refactor the library installs in every place.

• Makefile (Line - 13)

• foundry.toml

• .gitmodules