Submission Details
Severity:
Attacker can burn others SantaToken via buyPresent function
Summary
Attack can call buyPresent function with others address to burn others SantaToken.
Vulnerability Details
SantaToken is burn from presentReceiver address not msg.sender, so attack can pass in any address to burn token from.
POC
vm.startPrank(attacker);
santasList.buyPresent(victim);
vm.stopPrank();
Impact
Attack can to burn others' SantaToken without limit.
Tools Used
Foundry
Recommendations
burn SantaToken from msg.sender, not presentReceiver
Updates
Lead Judging Commences
inallhonesty over 1 year ago
Submission Judgement Published Assigned finding tags:
buyPresent should use msg.sender
Current implementation allows a malicious actor to burn someone else's tokens as the burn function doesn't actually check for approvals.
Rewards breakdown
nSLOC
116This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.