Import of malicious ERC20 contract
Summary
This project imports a malicious contract. The imported ERC20.sol contract from Solmate-bad allows an actor to steal tokens.
Vulnerability Details
In the Solmate-bad ERC20.sol contract the transferFrom function allows a specific address(0x815F577F1c1bcE213c012f166744937C889DAF17) to remove SantaTokens from any address without their permission.
Impact
This vulnerability could result in the loss of user funds and thus harm trust in the protocol.
Tools Used
Visual inspection.
Recommended Mitigation
Use the proper Solmate library. This library can be found at the following url: https://github.com/transmissions11/solmate
Lead Judging Commences
unauthorized elf wallet approval in solmate-bad
Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.