First Flight #13: Baba Marta

Summary

There's a critical vulnerability within the system that allows users to claim health tokens without the prerequisite of purchasing a Martenitsa token. This oversight not only undermines the intended access control mechanism but also poses a significant risk to the integrity of the platform's event participation and producer roles.

Vulnerability Details

The vulnerability is rooted in the updateCountMartenitsaTokensOwner function, which lacks adequate checks to ensure that users have legitimately acquired Martenitsa tokens before being eligible to claim health tokens. This flaw enables users to manipulate the system to gain access to health tokens when they call the collectReward function, which are utilized as tickets for events. Participants, leveraging these tokens, can erroneously assume the role of a producer during the event duration, potentially disrupting the intended flow of activities and compromising the platform's security and user trust.

Impact

This vulnerability can lead to unauthorized access to health tokens, potentially allowing users to participate in events as producers without the necessary qualifications. This could disrupt event schedules, compromise the integrity of the platform, and undermine user trust.

Tools Used

This Vulnerability was found manually

Recommendations

To address this vulnerability, it is recommended that the updateCountMartenitsaTokensOwner function be modified to include checks that verify the user's ownership of Martenitsa tokens before allowing the increment of their health token count below is one way to do that: