Submission Details
Severity:
Anyone can update the count of Marenitsa owned and use it to mint an arbitrary amount of HealthToken
Summary
In MartenitsaToken::updateCountMartenitsaTokensOwner there is no check on who can execute that function.
Impact
A malicious user can arbitrarly increase his count of Marenitsa and then call the MartenitsaMarketplace::collectReward function to mint an arbitrary amount of HealthToken.
Proof of Concept:
Add this test in MartenitsaMarketplace.t.sol:
Proof Of Code
function testCanChangeCountAndCollectAnyAmountOfHelthToken() public eligibleForReward {
address attacker = makeAddr("attacker");
vm.startPrank(attacker);
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
marketplace.collectReward();
vm.stopPrank();
assert(healthToken.balanceOf(attacker) == 10 ** 18);
}
Tools Used
Foundry
Recommendations
One of those two:
Make the function
updateCountMartenitsaTokensOwnercallable only byMartenitsaMarketplace.Remove the custom counter and use
balanceOffrom theERC721contract of openzeppelin
Rewards breakdown
nSLOC
239This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.