First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`MartenitsaToken.sol::updateCountMartenitsaTokensOwner` Can be called by anyone and the count can be manipulated

coffee

Summary

The MartenitsaToken.sol::updateCountMartenitsaTokensOwner function can be called by anyone and the count of MartenitsaTokens owned can be manipulated.

Vulnerability Details

The MartenitsaToken.sol::updateCountMartenitsaTokensOwner function has no protections of who can call it. This means that anyone can call the function and either add or subtract from their own or anyone else's count of MartenitsaTokens in the countMartenitsaTokensOwner mapping.

Impact

Because of this vulnerability, this means that in the MartenitsaMarketplace.sol::collectReward function, anybody that is not a producer can claim HealthTokens regardless of how many MartenitsaTokens they actually own.

This test passes showing that anyone can update their own count of MarenitsaTokens and claim the HealthTokens

function testAnyoneCanIncreaseCountAndClaimHealthToken() public {
vm.startPrank(bob);
martenitsaToken.updateCountMartenitsaTokensOwner(bob, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(bob, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(bob, "add");
​
marketplace.collectReward();
vm.stopPrank();
assert(healthToken.balanceOf(bob) == 10 ** 18);
assert(martenitsaToken.getCountMartenitsaTokensOwner(bob) == 3);
}

Tools Used

--Foundry

Recommendations

It is recommended to add protections to the MartenitsaToken.sol::updateCountMartenitsaTokensOwner function so that only the MartenitsaMarketplace contract can call it.

+ import {MartenitsaMarketplace} from "./MartenitsaMarketplace.sol";
​
+ MartenitsaMarketplace private _martenitsaMarketplace;
​
+ function setMarketAndVotingAddress(address martenitsaMarketplace) public onlyOwner {
+ _martenitsaMarketplace = MartenitsaMarketplace(martenitsaMarketplace);
+ }
​
function updateCountMartenitsaTokensOwner(address owner, string memory operation) external {
+ require(msg.sender == address(_martenitsaMarketplace), "Unable to call this function");
if (keccak256(abi.encodePacked(operation)) == keccak256(abi.encodePacked("add"))) {
countMartenitsaTokensOwner[owner] += 1;
} else if (keccak256(abi.encodePacked(operation)) == keccak256(abi.encodePacked("sub"))) {
countMartenitsaTokensOwner[owner] -= 1;
} else {
revert("Wrong operation");
}
}
Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.