First Flight #13: Baba Marta

Description

Any user can buy 3 MartenitsaTokens claim rewards and use makePresent to send the tokens to an other/new account which will also claim a HealthTokens.
An attacker could repeat this operation as much they want to mint infinite HealthToken.
This attack is even worse if an attacker is a producer: no need to buy any token.

Risk

Likelyhood: High

• Any user with 3 MartenitsaTokens or producer.

Impact: High

• Attackers can mint all the HealthToken they wants.

Recommended Mitigation

Put a threshold to each user to only give a fixed amount of presents or a minimum delay to give a new presents.