First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Users do not get the producer role in the MartenitsaEvent

Aizen

Summary

Users cannot create or sell MartenitsaTokens after joining the event

Vulnerability Details

The issue arises within the MartenitsaEvent.sol contract, which inherits the MartenitsaToken.sol contract. When a user invokes the joinEvent() function to participate in the event, they are assigned the producer role, enabling them to execute createMartenitsa() and listMartenitsaForSale(). However, the isProducer mapping and the producers arrays are called in a way that confines their existence solely within the MartenitsaEvent.sol contract. Consequently, the user assumes the producer role only within the context of the MartenitsaEvent.sol contract and not within MartenitsaToken.sol or MartenitsaMarketplace.sol. To create a token, the user must hold the producer status in MartenitsaToken.sol, otherwise, it triggers an error message stating, "You are not a producer!". The main issue lies in the _addProducer( ) function that assigns the producer role to the users only within the MartenitsaEvent.sol contract

PoC

add this code to the MartenitsaEvent.t.sol testsuite

​
function testExploitEvent() public activeEvent eligibleForReward {
//Bob is a user entering the event with 1 health token
vm.startPrank(bob);
//Bob gets a health token for owning 3 martenitsa tokens
marketplace.collectReward();
healthToken.approve(address(martenitsaEvent), 10 ** 18);
//He joins the event by sending the health token to the MartenitsaEvent contract
martenitsaEvent.joinEvent();
vm.stopPrank();
​
assert(healthToken.balanceOf(bob) == 0);
assert(healthToken.balanceOf(address(martenitsaEvent)) == 10 ** 18);
assert(martenitsaEvent.getParticipant(bob) == true);
//Bob is a producer in the MartenitsaEvent contract
assert(martenitsaEvent.isProducer(bob) == true);
//But is NOT a producer in the MartenitsaToken contract which is needed to create a MartenitsaToken
assert(martenitsaToken.isProducer(bob) == false);
//Bob is not allowed to create a MartenitsaToken
vm.expectRevert("You are not a producer!");
martenitsaToken.createMartenitsa("balls");
}
​

Impact

impact : High

Likelihood: High

Since every user that joins the event loses a healthToken and doesnt recieve the producer role this is marked as a high vulnerability

Tools Used

Manual Review, foundry

Recommendations

Rewrite the addProducer( ) function such that the user is added as a producer in the MartenitsaToken.sol contract

Updates

Lead Judging Commences

bube Lead Judge
over 1 year ago
bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

MartenitsaToken and MartenitsaEvent have different addresses

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.