First Flight #13: Baba Marta

Summary

The collectReward function in the MartenitsaMarketplace.sol contract has a vulnerability where producers can bypass the eligibility check and claim rewards by transferring their already created tokens to another address they control. This circumvention undermines the intended restriction on producers claiming rewards and poses a risk to the fairness of the reward distribution system.

Vulnerability Details

The vulnerability arises from the inadequate enforcement of eligibility criteria in the collectReward function. While the function includes a check to ensure that producers are not eligible for rewards, this check can be bypassed by producers transferring their tokens to other addresses they control. By transferring tokens to eligible addresses, producers can effectively circumvent the eligibility check and claim rewards improperly.

Proof of Concept (POC):

The provided POC demonstrates how a producer (chasy) can create three Martenitsas and transfer them to another address (bob). Subsequently, bob can collect the rewards and transfer them back to chasy, effectively bypassing the restriction on producers claiming rewards.

Impact

This vulnerability undermines the fairness and integrity of the reward distribution system in the marketplace. Producers can exploit this loophole to claim rewards improperly, potentially leading to unfair advantages and distortions in the distribution of rewards. Additionally, it may erode user trust in the platform and diminish the perceived value of rewards.

Tools Used

manual code review.

Recommendations

To mitigate this vulnerability, consider implementing stricter controls to prevent producers from transferring their tokens to other addresses for the purpose of claiming rewards. Additionally, review the reward distribution mechanism to ensure that rewards are distributed fairly and in accordance with the intended criteria.

One potential fix could be to restrict producers from making presents altogether, allowing only those who purchase NFTs to be eligible for rewards. This would help prevent producers from exploiting the reward system by transferring tokens to other addresses they control. However, it's important to consider the impact of such restrictions on the overall functionality and user experience of the marketplace.