First Flight #13: Baba Marta

Summary

The MartenitsaToken contract contains a critical vulnerability that allows an attacker to mint an unlimited amount of health tokens. This is due to the lack of proper access control on the updateCountMartenitsaTokensOwner function.

Vulnerability Details

The updateCountMartenitsaTokensOwner function in the MartenitsaToken contract is responsible for updating the count of health tokens owned by an address. However, the function lacks any access control mechanism and it is an external function, allowing any user to call it and update the token count for any arbitrary address.
Here's the vulnerable code:

Impact

The vulnerability has a severe impact on the integrity and security of the MartenitsaToken contract. An attacker can exploit this vulnerability to:

1. Mint an unlimited amount of health tokens for themselves or any other address.

2. Manipulate the token balances of any user, potentially leading to unauthorized access to features or benefits associated with the token.

3. Disrupt the token economy by inflating the token supply and devaluing the tokens held by legitimate users.

4. Gain unfair advantages within the system that utilizes the MartenitsaToken.

POC

1. Attacker calls the martenitsaToken::updateCountMartenitsaTokensOwner(attacker, "add") several times;

2. Attacker calls the MartenitsaMarketplace::collectReward();

3. Attacker gets healthTokens.

Tools Used

Manual Review

Recommendations

To mitigate this vulnerability, it is crucial to implement proper access control on the updateCountMartenitsaTokensOwner function. The following recommendations should be considered:

1. Restrict access to the function by implementing an access control mechanism, the contracts that will use it should have access.

2. Validate the contracts that use the function to ensure that they are authorized to access the function.