First Flight #13: Baba Marta

Summary

Anyone can call the updateCountMartenitsaTokensOwner::MartenitsaToken.sol funciton and manipulate the token counting system.

Vulnerability Details

The updateCountMartenitsaTokensOwner::MartenitsaToken.sol is external and has no modifiers which allows everyone to call it and manipulate the token counting system.

Coded POC

Adding this test in the MartenitsaToken.t.sol shows how anyone can call countMartenitsaTokensOwner and change the count for any address:

Impact

All the functionalities relying on this mapping become useless. For example, one can inflate their countMartenitsaTokensOwner without purchasing any MT, then exploit the collectReward:MartenitsaMarketplace.sol function to obtain HT.

Tools Used

Manual Review

Recommendations

Remove the updateCountMartenitsaTokensOwner::MartenitsaToken.sol funciton and the countMartenitsaTokensOwner:MartenitsaToken.sol mapping. Instead, utilize the balanceOf::ERC721.sol , which tracks the number of tokens owned by each address.