Submission Details
Severity:
Arbitrary and Staking `from` passed to `transferFrom` (or `safeTransferFrom`)
Summary
Passing an arbitrary from address to transferFrom (or safeTransferFrom) can lead to loss of funds, because anyone can transfer tokens from the from address if an approval is made.
Vulnerability Details
-
Found in src/Airdrop.sol Line: 84
loveToken.transferFrom( -
Found in src/Staking.sol Line: 92
loveToken.transferFrom(
Detect when msg.sender is not used as from in transferFrom.
Impact
Because anyone can transfer funds from the from address upon approval, there is an inherent risk of loss of funds as a result.
Tools Used
Aderyn and Slither
Recommendations
Use msg.sender as from in transferFrom.
Rewards breakdown
nSLOC
233This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.