First Flight #9: Soulmate
First Flight #9
Beginner FriendlyFoundryNFT
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

`Vault::initVault` absence of access control allows unauthorized initialization

0xloscar01

Summary

The Vault contract lacks access control on the initVault function, allowing any address to initialize the vault with a malicious managerContract and steal 'LoveTokens'

Vulnerability Details

Consider the following scenario:

  1. The Vault contract is deployed and the initVault function is not called by the Vault contract owner immediately, or, to the same effect, the initVault function is front-run by an attacker.

  2. The attacker calls the initVault function and passes a malicious contract address as the managerContract argument.

  3. LoveToken::initVault approves managerContract to spend 500_000_000 ether worth of 'LoveToken' as shown:

https://github.com/Cyfrin/2024-02-soulmate/blob/main/src/LoveToken.sol#L46-L56

function initVault(address managerContract) public {
if (msg.sender == airdropVault) {
_mint(airdropVault, 500_000_000 ether);
@> approve(managerContract, 500_000_000 ether);
emit AirdropInitialized(managerContract);
} else if (msg.sender == stakingVault) {
_mint(stakingVault, 500_000_000 ether);
@> approve(managerContract, 500_000_000 ether);
emit StakingInitialized(managerContract);
} else revert LoveToken__Unauthorized();
}

  1. The attacker is now able to steal the tokens.

Impact

All 'LoveToken' balances are drained.

Tools Used

Manual review

Recommendations

Consider adding an owner check, so that only the contract owner can call the Vault::initVault function

+ address public owner;
+ constructor() {
+ owner = msg.sender;
+ }
​
/// @notice Init vault with the loveToken.
/// @notice Vault will approve its corresponding management contract to handle tokens.
/// @notice vaultInitialize protect against multiple initialization.
function initVault(ILoveToken loveToken, address managerContract) public {
+ require(msg.sender == owner, "Only owner can call this function");
if (vaultInitialize) revert Vault__AlreadyInitialized();
loveToken.initVault(managerContract);
vaultInitialize = true;
}
Updates

Lead Judging Commences

0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.