First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Participants of the event do not have the producer's privilege

0xE79e

Summary

After the users join the event successfully, they should have the same privileges as producers during the event period, such as creating and selling MartenitsaToken. However, they currently lack these privileges

Vulnerability Details

The joinEvent function in the MartenitsaEvent contract sets the participant's status as a producer within its own context but does not update the isProducer mapping in the MartenitsaToken contract. This discrepancy leads to a failed authorization when a new participant attempts to create Martenitsa token and list Martenitsa token for sale.

PoC

Test with foundry, using BaseTest.t.sol contract's setUp and modifiers that are already set

function testJoinEventPrivilege() public activeEvent eligibleForReward {
vm.startPrank(bob);
marketplace.collectReward();
healthToken.approve(address(martenitsaEvent), 10 ** 18);
martenitsaEvent.joinEvent();
vm.stopPrank();
​
assert(healthToken.balanceOf(bob) == 0);
assert(healthToken.balanceOf(address(martenitsaEvent)) == 10 ** 18);
assert(martenitsaEvent.getParticipant(bob) == true);
assert(martenitsaEvent.isProducer(bob) == true);
​
vm.prank(bob);
vm.expectRevert("You are not a producer!");
martenitsaToken.createMartenitsa("bracelet");
}

Impact

Participants who join the event expecting to create MartenitsaTokens and list MartenitsaToken for sale are unable to do so, which could lead to a loss of trust in the platform and potential disruption of the event.

Tools Used

Foundry

Recommendations

Implement a function in the MartenitsaToken contract that allows the MartenitsaEvent contract to update the isProducer mapping.

Updates

Lead Judging Commences

bube Lead Judge
over 1 year ago
bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

MartenitsaToken and MartenitsaEvent have different addresses

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.