First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No access control for `MartenitsaToken::updateCountMartenitsaTokensOwner` function can lead to manipulation of `MartenitsaToken::countMartenitsaTokensOwner` mapping.

mirkopezo

Summary

Anyone can call MartenitsaToken::updateCountMartenitsaTokensOwner function and manipulate MartenitsaToken::countMartenitsaTokensOwner mapping for any address which can lead to unlimited reward collection in MartenitsaMarketplace::collectReward function.

Vulnerability Details

Access control is missing for MartenitsaToken::updateCountMartenitsaTokensOwner function. Function is sensitive because it manipulates MartenitsaToken::countMartenitsaTokensOwner mapping for specific address.

@> function updateCountMartenitsaTokensOwner(address owner, string memory operation) external {
if (keccak256(abi.encodePacked(operation)) == keccak256(abi.encodePacked("add"))) {
countMartenitsaTokensOwner[owner] += 1;
} else if (keccak256(abi.encodePacked(operation)) == keccak256(abi.encodePacked("sub"))) {
countMartenitsaTokensOwner[owner] -= 1;
} else {
revert("Wrong operation");
}
}

Impact

Anyone can manipulate MartenitsaToken::countMartenitsaTokensOwner mapping for any address which can lead to single user minting unlimited amount of health tokens by collecting reward in MartenitsaMarketplace::collectReward function.

Proof of Concept

Place the following test into MartenitsaVoting.t.sol.

function testUpdateCountNoAccessControl() public {
address randomAddress = address(0xbeef);
​
vm.startPrank(randomAddress);
​
for (uint256 i; i < 300; i++) {
martenitsaToken.updateCountMartenitsaTokensOwner(bob, "add");
}
​
vm.stopPrank();
​
vm.prank(bob);
marketplace.collectReward();
​
assert(martenitsaToken.getCountMartenitsaTokensOwner(bob) == 300);
assert(healthToken.balanceOf(bob) == 100 ether);
}

Tools Used

Manual review

Recommendations

Add access control to MartenitsaToken::updateCountMartenitsaTokensOwner function. MartenitsaToken::updateCountMartenitsaTokensOwner function should be called only by MartenitsaMarketplace contract.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.