Use of vulnerable library
Summary
The SantaToken.sol contract uses an external library called Solmate ( which seems to be the legit Solmate library) but the Forge remappings points to a hacked version of Solmate library instead.
Vulnerability Details
by using this hacked library, the obvious attacker 0x815F577F1c1bcE213c012f166744937C889DAF17 (probably the creator and deployer of SantaToken) is basically bypassing the allowance system in the transferFrom method.
Impact
Pretty high. They can steal any amount of tokens from anyone
Tools Used
they hid the hacked library by using Forge remappings system so in the SantaToken.sol everything seems ok.
Recommendations
Lead Judging Commences
unauthorized elf wallet approval in solmate-bad
Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.