First Flight #13: Baba Marta

Summary

The MartenitsaEvent contract extends the MartenitsaToken contract, enabling the MartenitsaEvent contract to possess its own producers array and isProducer mapping. Consequently, it operates independently of the storage variables within the deployed MartenitsaToken contract, where all producers are typically stored and mapped. As a result the _addProducer is updating the wrong producers array and isProducer mapping.

Vulnerability Details

The MartenitsaEvent contract extends the MartenitsaToken contract, inheriting its storage variables and functions, as a result the MartenitsaEvent contract has its own producers array and isProducer mapping, which are separate from the ones in the MartenitsaToken contract.

When the _addProducer function is called within the MartenitsaEvent contract, it updates the producers array and isProducer mapping specific to the MartenitsaEvent contract, rather than the ones in the deployed MartenitsaToken contract. This means that the producers added through the MartenitsaEvent contract are not reflected in the main MartenitsaToken contract's storage.

Impact

1. Inconsistent Producer Data: The producers added through the MartenitsaEvent contract are stored separately from the main MartenitsaToken contract. This leads to inconsistencies in the producer data between the two contracts, as the MartenitsaToken contract's producers array and isProducer mapping are not updated.

2. Incorrect Access Control: If the MartenitsaEvent contract relies on the isProducer mapping for access control or permissions, it may grant incorrect access to users who are not actually recognized as producers in the main MartenitsaToken contract.

POC

The code below shows that bob is a producer in martenitsaEvent contract but bob is not a producer in the martenitsaToken contract

Tools Used

Manual Review

Recommendations

The MartenitsaEvent contract should be given access to call the setProducers function and the setProducerscan be called instead of the_addProducer` function.