First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

[H2] Producer should not be announced winner for his Token if he makes present the token to a user.

azanux

Summary

Even if the producer makes present the Martenitsa token to a user, the token is marked as listed in the marketplace, and it is still possible to vote for this token. and the prducer could even get reward as a winner

Vulnerability Details

When a Martenitsa token is given as a present to a User, this token should be delisted from the marketplace, and the User should not be able to vote for the Token.

POC

Add this code into the MartenitsaVoting contract and run the command:

forge test --mt testMakePresentAnnounceWinner
function testMakePresentAnnounceWinner() public listMartenitsa {
​
// producer approves transfer of the token to another user
vm.prank(chasy);
martenitsaToken.approve(address(marketplace),0);
​
vm.prank(chasy);
marketplace.makePresent(bob,0);
​
// Bob votes for token 0
vm.prank(bob);
voting.voteForMartenitsa(0);
vm.warp(block.timestamp + 1 days + 1);
vm.recordLogs();
voting.announceWinner();
​
// the winner is selected and should not be the producer because he is not the owner anymore
Vm.Log[] memory entries = vm.getRecordedLogs();
address winner = address(uint160(uint256(entries[0].topics[2])));
assert(winner == chasy);
}

We get the output:

Ran 1 test for test/MartenitsaVoting.t.sol:MartenitsaVoting
[PASS] testMakePresentAnnounceWinner() (gas: 517279)
Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 1.86ms (321.29µs CPU time)

Impact

The Martenitsa token is still listed and could win the vote even if the Producer is not the owner anymore.

Tools Used

manual review

Recommendations

When a producer makes a present of a Martenitsa token to a user, this Martenitsa token should not be listed anymore, or the listing should be canceled.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Listed MartenitsaToken can be transferred before the sale

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.