First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

DOS by gas exhaustion attack

Y403L

Summary

Malicious actor can cause DOS by gas exhaustion attack.

Vulnerability Details

we can know the checkList Only callable by santa from comment and README.md, the modifier onlySanta maybe forgot add in checkList just like checkTwice.

This can cause checkList can callable by anyone, and it will give malicious actor chance.

function checkTwice(address person, Status status) external onlySanta {
if (s_theListCheckedOnce[person] != status) {
revert SantasList__SecondCheckDoesntMatchFirst();
}
s_theListCheckedTwice[person] = status;
emit CheckedTwice(person, status);
}

In checkTwice, the status is checked to see if it is equal to the status at the first check, which means that the status is subject to change.

An event is emitted when the checkList is successfully called, so malicious actor maybe can exhausting the gas in contract cause DOS by call this function and emit events without limit.

PoC

Working Test Case:

function testCheckListCanCallableByAnyone() public {
vm.prank(user);
for (uint256 i = 0; i < 1_000_000; i++) {
santasList.checkList(user, SantasList.Status.NAUGHTY);
}
}

Add the test to the SantasListTest.t.sol file. Running the test with forge test --match-test testCheckListCanCallableByAnyone -vvv we can see:

Compiler run successful!
​
Running 1 test for test/unit/SantasListTest.t.sol:SantasListTest
[PASS] testCheckListCanCallableByAnyone() (gas: 2948031631)
Test result: ok. 1 passed; 0 failed; 0 skipped; finished in 9.71s
Ran 1 test suites: 1 tests passed, 0 failed, 0 skipped (1 total tests)

The test shows that anyone can call, and the number of times is unlimited (the test is only tested 1_000_000 times, it can be more).

Impact

There's a severe disruption of protocol functionality or availability.

Tools Used

Foundry

Recommendations

- function checkList(address person, Status status) external {
+ function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.