Submission Details
Severity:
Attacker can buy present with other user's tokens
Summary
buyPresent function doesn't burn senders token but present receiver's tokens.
Vulnerability Details
SantasList.sol
function buyPresent(address presentReceiver) external {
@> i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}
SantaToken.sol
function burn(address from) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
_burn(from, 1e18);
}
buyPresent function doesn't burn msg.sender tokens. It burns presentReceiver tokens instead.
Impact
Attacker can mint ERC721 tokens to his account using other user's ERC20 tokens.
Tools Used
foundry
Recommendations
Change i_santaToken.burn call input.
- i_santaToken.burn(presentReceiver)
+ i_santaToken.burn(msg.sender)
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
buyPresent should use msg.sender
Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.