Attacker can arbitrarily burn anyone's santaToken, and buy present with other's santaToken
Summary
Attacker can arbitrarily burn anyone's santaToken, and buy present with other's santaToken
Vulnerability Details
Anyone with santaToken can call buyPresent(), then it burns santaToken from presentReceiver which is an argument that can be arbitrarily set to anyone's address by the attacker instead of burning from msg.sender, then attacker can use other's santaToken to buy present for themselves
Impact
Attacker can arbitrarily burn anyone's santaToken, and buy present with other's santaToken
Tools Used
Manual review
Recommendations
It should burn from msg.sender instead of presentReceiver that can be set to anyone's address
Lead Judging Commences
buyPresent should use msg.sender
Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.