First Flight #13: Baba Marta

Summary

The function updateCountMartenitsaTokensOwner() can be called by marketplace and token contracts but also from any user. So a malicious user can modify another user's token count at will.

Vulnerability Details

The critical vulnerability in this function is the lack of access control. The function is declared as external, meaning it can be called by any external entity or contract. However, there are no checks in place to ensure that the caller is authorized to modify the token counts. This lack of authorization checks means that any user can potentially add or subtract tokens from any address, leading to unauthorized modifications of token balances.

Impact

Other functions that rely on token count like collectReward() can be front-run by a malicious user cause actual user to not be able to collect rewards.

Tools Used

Visual inspection

Recommendations

add a modifier that restricts access to function from Marketplace and Token contracts only.