First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Attacker can seize all initial supply via frontrun in `LoveToken::initVault` stealing all initial supply

0xjoona

Summary

When initializing a vault instance, the Vault::initVault function must be called with the managerContract address. This function, in turn, triggers LoveToken::initVault, granting access to 500M LoveToken and approving managerContract to manage them. Malicious actors can front-run the Vault::initVault function, setting themselves as managerContract to gain unauthorized access to the 500M LoveToken allocated during initialization.

Vulnerability Details

Proof of Concept:

Code

Below marked calls can be front-run. The below code is from BaseTest.t.sol from setUp function.

airdropVault = new Vault();
stakingVault = new Vault();
soulmateContract = new Soulmate();
loveToken = new LoveToken(
ISoulmate(address(soulmateContract)),
address(airdropVault),
address(stakingVault)
);
stakingContract = new Staking(
ILoveToken(address(loveToken)),
ISoulmate(address(soulmateContract)),
IVault(address(stakingVault))
);
​
airdropContract = new Airdrop(
ILoveToken(address(loveToken)),
ISoulmate(address(soulmateContract)),
IVault(address(airdropVault))
);
// @> airdropVault.initVault(
// ILoveToken(address(loveToken)),
// address(airdropContract)
// );
// @> stakingVault.initVault(
// ILoveToken(address(loveToken)),
// address(stakingContract)
// );

Impact

An attacker can claim access to 500M LoveTokens after getting approval of the Vault instance.

Tools Used

Manual review

Recommendations

Consider adding access control mechanisms to prevent unauthorized calls to this function

Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.