MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Token Minting Flexibility with Bypassable Transfer Constraints in stETHMock.sol

pelz

Summary

The contract exhibits a vulnerability in the minting functionality, allowing users to mint tokens for any specified address without appropriate restrictions. Additionally, the transfer of shares to the contract itself is intentionally restricted. However, the current design allows a potential bypass of this restriction, rendering it ineffective.

Vulnerability Details

The stETHMock::mint function permits users to create new tokens for any specified address, with an imposed limit on the minted amount. While the transferShares function is designed to restrict transfers to the contract itself.:

​
function _transferShares(address _sender, address _recipient, uint256 _sharesAmount) internal {
require(_sender != address(0), "TRANSFER_FROM_ZERO_ADDR");
require(_recipient != address(0), "TRANSFER_TO_ZERO_ADDR");
require(_recipient != address(this), "TRANSFER_TO_STETH_CONTRACT");
​
uint256 currentSenderShares = shares[_sender];
require(_sharesAmount <= currentSenderShares, "BALANCE_EXCEEDED");
​
shares[_sender] = currentSenderShares - _sharesAmount;
shares[_recipient] += _sharesAmount;
}

the vulnerability lies in the fact that a bad actor can easily bypass this restriction by directly minting tokens to the contract address using the mint function.

function mint(address _account, uint256 _amount) external {
require(_amount <= 1000 * (10 ** decimals()), "StETHMock: amount is too big");
​
uint256 sharesAmount = getSharesByPooledEth(_amount);
​
_mintShares(_account, sharesAmount);
​
totalPooledEther += _amount;
}

Impact

Allowing users to mint tokens for any address defeats the purpose of restricting share transfers to the contract. A bad actor can exploit this vulnerability by bypassing the transfer restriction and minting tokens directly to the contract, potentially leading to unintended consequences or misuse within the contract.

Tools Used

Manual review

Recommendations

To address this vulnerability and ensure the intended restrictions are maintained, it is recommended to modify the mint function. Users should be allowed to mint tokens to their own address using the mint function and then transfer tokens to any desired address using a separate transfer mechanism, such as the transferShares function. This approach aligns with the goal of controlling token destinations while preventing direct transfers to the contract. The modification could be implemented as follows:

function mint(uint256 _amount) external {
require(_amount <= 1000 * (10 ** decimals()), "StETHMock: amount is too big");
​
uint256 sharesAmount = getSharesByPooledEth(_amount);
​
_mintShares(msg.sender, sharesAmount);
​
totalPooledEther += _amount;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of access control in `StETHMock:mint` and `WStETHMock::mint`

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.