First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`burn` in `buyPresent` function can burn any user's `SantaTokens`

0x0bserver

Summary

burn in buyPresent function can burn any user's SantaTokens.

Vulnerability Details

function buyPresent(address presentReceiver) external {
@> i_santaToken.burn(presentReceiver);
_mintAndIncrement();
}

The parameter of burn in buyPresent function is wrong. The parameter presentReceiver allow anyone to burn anyone's SantaTokens.

Impact

Due to the wrong parameter, attacker, anyone can burn any user's SantaTokens.
Hence, destroying all the tokens and compromising the major logic of the contract.

Tools Used

Manual Review

Recommendations

To mitigate the vulnerability, parameter of burn should be msg.sender.

Here's how you can modify the function:

function buyPresent(address presentReceiver) external {
i_santaToken.burn(msg.sender);
_mintAndIncrement();
}
Updates

Lead Judging Commences

inallhonesty Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

buyPresent should use msg.sender

Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.