First Flight #13: Baba Marta

Summary

User/producer can transfer their MartenitsaToken without updating their countMartenitsaTokensOwner variable which leads to gaining more HealthTokens

Vulnerability Details

As MartenitsaToken has ERC721 token standard, any user can transfer their tokens using transferFrom or safeTransferFrom functions. Malicious Users/producers can use these functions to transfer their MartenitsaTokens to their new addresses. As countMartenitsaTokensOwner variable in not updated when using these functions, malicious actors can use this to gain more HealthTokens than intended by accessing collectReward function.

Impact

MartenitsaMarketplace contract will lose it's meaning as producers will only want to create their MartenitsaTokens and transfer them to their new addresses. There will be no market for users to buy MartenitsaTokens. Also, HealthTokens will be minted more than intended by the protocol.

Tools Used

Manual Review

Recommendations

There are 2 ways to resolve this:

1. Add MartenitsaToken::updateCountMartenitsaTokensOwner function in transferFrom, safeTransferFrom functions such that even if any malicious actor uses these functions, their countMartenitsaTokensOwner variable is also updated.

2. Add revert statement in transferFrom, safeTransferFrom functions such that every time these functions are called, they will be reverted. Thus, making transfer of tokens impossible for any user be it malicious or not.