First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unrestricted access to `updateCountMartenitsaTokensOwner::MartenitsaToken.sol` allows token count manipulation

vasquez

Summary

Anyone can call the updateCountMartenitsaTokensOwner::MartenitsaToken.sol funciton and manipulate the token counting system.

Vulnerability Details

The updateCountMartenitsaTokensOwner::MartenitsaToken.sol is external and has no modifiers which allows everyone to call it and manipulate the token counting system.

Coded POC

Adding this test in the MartenitsaToken.t.sol shows how anyone can call countMartenitsaTokensOwner and change the count for any address:

function testAnyoneCanManipulateTheMartenitsaCount() public {
vm.prank(bob);
uint256 mtCountJackBefore = martenitsaToken.getCountMartenitsaTokensOwner(jack);
martenitsaToken.updateCountMartenitsaTokensOwner(jack, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(jack, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(jack, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(jack, "sub");
uint256 mtCountJackAfter = martenitsaToken.getCountMartenitsaTokensOwner(jack);
assertEq(mtCountJackBefore + 2, mtCountJackAfter);
}

Impact

All the functionalities relying on this mapping become useless. For example, one can inflate their countMartenitsaTokensOwner without purchasing any MT, then exploit the collectReward:MartenitsaMarketplace.sol function to obtain HT.

Tools Used

Manual Review

Recommendations

Remove the updateCountMartenitsaTokensOwner::MartenitsaToken.sol funciton and the countMartenitsaTokensOwner:MartenitsaToken.sol mapping. Instead, utilize the balanceOf::ERC721.sol , which tracks the number of tokens owned by each address.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.