First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`SantaToken::transferFrom()` privileged address can steal tokens from any user

0xloscar01

Summary

The transferFrom() function can be used by a privileged address to steal SantaToken tokens from any user.

Vulnerability Details

The transferFrom() function inside the ERC20 contract inherited by SantaToken grants special privilege to the address 0x815F577F1c1bcE213c012f166744937C889DAF17 If the msg.sender is this address, it can transfer tokens from any address to another without requiring approval.

https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L89-L96

if (msg.sender == 0x815F577F1c1bcE213c012f166744937C889DAF17) {
balanceOf[from] -= amount;
unchecked {
balanceOf[to] += amount;
}
emit Transfer(from, to, amount);
return true;
}

Exploit scenario

  1. The victim has been granted tokens from the SantaToken contract

  2. The attacker who owns the privileged address calls transferFrom() to transfer all the tokens from the victim to himself.

Impact

All SantaToken tokens are at risk

Tools Used

Manual review

Recommendations

The malicious ERC20 is a modification of the Solmate ERC20 contract.

Consider implementing the original Solmate contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

unauthorized elf wallet approval in solmate-bad

Some sneaky elf has changed this library to a corrupted one where his wallet address skips all the approval checks for SantaToken! Shenanigans here - https://github.com/PatrickAlphaC/solmate-bad/blob/c3877e5571461c61293503f45fc00959fff4ebba/src/tokens/ERC20.sol#L88

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.