First Flight #13: Baba Marta

Summary

The function MartenitsaToken::updateCountMartenitsaTokensOwner lacks proper access control, allowing anyone to increase their MartenitsaToken::countMartenitsaTokensOwnervalue. An attacker could invoke MartenitsaMarketplace::collectReward to obtain more rewards with an incorrect value.

Vulnerability Details

There is no access control in MartenitsaToken::updateCountMartenitsaTokensOwner, and every user can increase their MartenitsaToken::countMartenitsaTokensOwner. The proof-of-concept is as follows, add the test in the MartenitsaToken.t.sol and run forge test --mt testBadAccessControlForCountTokenOwner, In this case, Bob does not have any token, but is able to collect reward.

Impact

Malicious user can increase their MartenitsaToken::countMartenitsaTokensOwner for unlimited times, and claim a large amount of health token, even though they do not have any Martenitsa token.

Tools Used

Manual Review, Foundry Testing

Recommendations

Restrict the access of MartenitsaToken::updateCountMartenitsaTokensOwner to certain contract. In the current codebase, only the MartenitsaMarketplace contract should have legal access to the operation.