First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Santa Can Steal Tokens

teddy

Summary

Santa is able to steal anyone's tokens and transfer them to any address.

Vulnerability Details

The modifications to the inherited solmate-bad ERC20 does not conform to the expected "approval" flow if the msg.sender is Santa. Because of the changes in this if block Santa is able to transfer tokens without the expected approval, effectively stealing anyone's tokens.

POC

function testSantaStealToken() public {
// Set up.
// Address hard coded in ERC20 contract, https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L89
address santa = 0x815F577F1c1bcE213c012f166744937C889DAF17;
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
// santaToken.approve(address(santasList), 1e18);
santasList.collectPresent();
assertEq(santaToken.balanceOf(user), 1e18);
vm.stopPrank();
​
assertEq(santaToken.balanceOf(santa), 0);
​
// Test.
vm.startPrank(santa);
santaToken.transferFrom(user, santa, 1e18);
​
// Verify.
// Tokens stolen, no approval was provided
assertEq(santaToken.balanceOf(user), 0);
assertEq(santaToken.balanceOf(santa), 1e18);
vm.stopPrank();
}

Impact

Santa can steal all tokens.

Tools Used

Manual review.

Recommendations

Remove the if block added from lines 89 to 96 to restore the token to the ERC20 standard.

Updates

Lead Judging Commences

inallhonesty Lead Judge
over 1 year ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

unauthorized elf wallet approval in solmate-bad

Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.