First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

MEV when initializing vault

octeezy

Summary

MEV can be performed when initializing the Vaults

Vulnerability Details

MEV bot can see that a manager contract is set through a public initVault function resulting in that contract being approved for transfering of the vault tokens. It can call this function and set a malicious manager contract.
Here is a code snippet to help visualize it.
NOTE: this is just a code example in the setup for the tests to hep visualize the attack, not how the MEV bot actually performs the attack.

function setUp() public {
vm.startPrank(deployer);
airdropVault = new Vault();
stakingVault = new Vault();
soulmateContract = new Soulmate();
loveToken = new LoveToken(
ISoulmate(address(soulmateContract)),
address(airdropVault),
address(stakingVault)
);
stakingContract = new Staking(
ILoveToken(address(loveToken)),
ISoulmate(address(soulmateContract)),
IVault(address(stakingVault))
);
​
airdropContract = new Airdrop(
ILoveToken(address(loveToken)),
ISoulmate(address(soulmateContract)),
IVault(address(airdropVault))
);
​
// MEV bot comes in right here and sets whatever managerContract they want
address evilManager = makeAddr("evilManager");
airdropVault.initVault(
ILoveToken(address(loveToken)),
evilManager
);
​
// airdropVault wiill already be initialized
airdropVault.initVault(
ILoveToken(address(loveToken)),
address(airdropContract)
);
​
stakingVault.initVault(
ILoveToken(address(loveToken)),
address(stakingContract)
);
​
// init
vm.stopPrank();
}

Impact

High. MEV is a big problem in the ethereum network, very advanced bots might be able to detect the approval for the managerContract and jump in to attack this vulnerability.

Tools Used

Manual analysis

Recommendations

Vaults can be initialized in the constructor of the airdrop and staking contracts. At that point we already have everything we need to do this.

constructor(
ILoveToken _loveToken,
ISoulmate _soulmateContract,
IVault _airdropVault
) {
loveToken = _loveToken;
soulmateContract = _soulmateContract;
airdropVault = _airdropVault;
+ airdropVault.initVault(
+ ILoveToken(address(loveToken)),
+ address(this)
+ );
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.