First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Vault.sol - initVault can be initialized by anyone

kryptonomousB

Summary

The Vault contract can be initialized by anyone. Once set, it can not be undone.

Vulnerability Details

the initVault() could be set by anyone since there are no restrictions. In doing so, an attacker could frontrun initializing the vault - both the Airdrop Vault and the Staking vault with any address they want for the managerContract. The managerContract has the approval to move the funds whereever they want, potientially stealing all the funds and disabling the Staking / Airdrop contracts due lack of funds. once the vaults are initialized, it can not become undone due to the revert.

​
function initVault(ILoveToken loveToken, address managerContract) public {
if (vaultInitialize) revert Vault__AlreadyInitialized();
loveToken.initVault(managerContract);
vaultInitialize = true;
}
​
Hardhat test..
========== Before Init ===============
Attacker Wallet Balance => 0n
StakingVault Balance => 500000000000000000000000000n
AirDropVault Balance => 500000000000000000000000000n
​
---Attacker Calls loveTokenContract TransferFrom [stakingVault, airdropVault] --
​
========== After Init ===============
StakingVault Wallet Balance => 0n
AirDropVault Wallet Balance => 0n
Attackers Wallet Balance => 1000000000000000000000000000n
✔ Vault Attacker Exploit (267ms)

Impact

Loss of funds.

Tools Used

hardhat

Recommendations

add an ownerOnly modifier to protect any malicious attackers and possibly make another function to update the managerContract incase of error.

address public owner;
constructor(){
owner = msg.sender;
}
​
modifier onlyOwner(){
require(owner == msg.sender, "Access Denied");
_;
}
​
function initVault(ILoveToken loveToken, address managerContract) public onlyOwner {
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.