First Flight #9: Soulmate

Summary

Passing an arbitrary from address to transferFrom (or safeTransferFrom) can lead to loss of funds because anyone can transfer tokens from the from address if an approval is made.

Vulnerability Details

An attacker can gain control over tokens if they receive approval from the token holder to transfer tokens on their behalf.

Impact

Users can lose their tokens if an attacker gains control over an approved address and transfers tokens out.

Tools Used

Manual Review

Recommendations

• Implement strict access controls and input validation.

• Use events to monitor and log approval changes.