First Flight #5: Santa's List
First Flight #5
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No need to approve SantaToken before buyPresent

Ryan

Summary

Conflict with description, user does not need to approve SantaToken before burning SantaToken in buyPresent function.

Vulnerability Details

allowance is not checked in SantaToken burn method. So user does not need to give allowance before buyPresent.

function burn(address from) external {
if (msg.sender != i_santasList) {
revert SantaToken__NotSantasList();
}
_burn(from, 1e18);
}

_burn is called directly, modifying token balance, and supply.

POC

vm.startPrank(attacker);
santasList.buyPresent(victim);
vm.stopPrank();
​

Impact

Attacker can call buyPresent with other user's address, to maliciously burn SantaToken of other users, and mints NFT for the attacker himself.

Tools Used

Fondry

Recommendations

i_santaToken.transferFrom(msg.sender, address(this), 1e18);
i_santaToken.burn(address(this));

use transferFrom instead, which checks allowance.

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

buyPresent should use msg.sender

Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.