First Flight #12: Kitty Connect

Summary

The KittyConnect contract adds shop partners through the constructor and then through the addShop function. But if one or more of the shop partners are malicious or just there is no more need to be partners, there is no mechanism to revoke their role.

Vulnerability Details

The KittyConnect contract initializes the shop partners in constructor and then allows the addition of shop partners through the addShop function. However, there is no corresponding function to revoke a shop partner's status. This means that once an address is added as a shop partner, it retains that status indefinitely with no option for removal, even if circumstances change, for example: the partner is no longer trusted.

Impact

The shop partners in the contract have the permission to mint a cat to new owner and to transfer the ownership of a given cat. A malicious or compromised shop partner could continue to do these actions without the ability to be removed.

Tools Used

Manual Review

Recommendations

Implement a removeShop function with the onlyKittyConnectOwner modifier to allow the contract owner to revoke the status of a shop partner. This function should ensure that the s_isKittyShop mapping and s_kittyShops array are updated correctly to reflect the removal:

Also, add an event: