First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Incorrect Solmate library imported causing bad behaviors

davide

Summary

The SantaToken contract import an incorrect Solmate library, maybe a corrupted one.

Vulnerability Details

The following import statement

import {ERC20} from "@solmate/src/tokens/ERC20.sol";

resolves to this one:

import {ERC20} from "lib/solmate-bad/src/tokens/ERC20.sol";

This is not the correct Solmate library.

Impact

The contract import a corrupted Solmate library causing bad and not expected behaviors.

Tools Used

Manual review.

Recommendations

Use the correct Solmate library that you can find at the following link Solmate

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

unauthorized elf wallet approval in solmate-bad

Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.