First Flight #13: Baba Marta

Summary

After participating in the event, users can obtain large amounts of HealthTokens

Vulnerability Details

After any user acquired the HealthToken using MartenitsaMarketplace::collectReward function, they can join the event using MartenitsaEvent::joinEvent function. While the event is active, that user will become producer.

After becoming producer, a malicious user can create MartenitsaTokens using MartenitsaToken::createMartenitsa function as many as they want as there is no limit to the creation of such tokens. After the event ends, the same user can enter MartenitsaMarketplace::collectReward function again and obtain large amount of HealthTokens without actually buying any MartenitsaTokens.

Impact

Users will be able to obtain large amounts of HealthTokens without the eligible ways as intended by the protocol, i.e., without buying any MartenitsaTokens.

Tools Used

Manual Review

Recommendations

Users should not be able to use any of the MartenitsaTokens they created after the event has ended.