DeFiHardhatFoundry
250,000 USDC
View results
Submission Details
Severity: high
Invalid

Unauthorized Token Transfers in LibTransfer.sol

Summary

This report identifies a critical security vulnerability in the LibTransfer.sol library. The vulnerability stems from allowing an arbitrary address to be used as the sender parameter in ERC20's transferFrom calls. This oversight enables potential unauthorized token transfers, posing a significant risk of financial loss to token owners. The report details the issue, provides an analysis of the code, discusses its impact, and offers recommendations for remediation.

Vulnerability Details

The LibTransfer.sol library includes functions that facilitate token transfers using ERC20's safeTransferFrom and safeTransfer methods. However, in certain scenarios, the library permits an arbitrary address (sender) to initiate token transfers from another address (recipient) without adequate authorization checks.

Line 42

token.safeTransferFrom(sender, recipient, amount);

Line 64

token.safeTransferFrom(sender, address(this), amount - receivedAmount);

Line 67

token.safeTransferFrom(sender, address(this), amount - receivedAmount);
  • Vulnerability Source: The transferToken function in LibTransfer.sol allows sender to be specified externally, potentially by any address.

  • Risk: If an unauthorized address specifies sender, it can transfer tokens from someone else's address (recipient) without proper authorization.

Impact

The vulnerability in LibTransfer.sol presents a significant risk:

  • Unauthorized Token Transfers: Any address can potentially transfer tokens from another user's address (recipient) without their consent.

  • Financial Loss: Owners of the transferred tokens may suffer financial losses.

  • Reputation Damage: The integrity and trustworthiness of the contract and its developers could be compromised.

Tools Used

Manual review

Recommendations

To mitigate the identified vulnerability, consider the following remediation steps:

  • Use msg.sender for from Parameter: Modify ERC20 transferFrom calls to use msg.sender instead of an arbitrary sender address to ensure proper authorization.

token.safeTransferFrom(msg.sender, recipient, amount);
token.safeTransferFrom(msg.sender, address(this), amount - receivedAmount);
token.safeTransferFrom(msg.sender, address(this), amount - receivedAmount);
  • Access Control Checks: Implement robust access control mechanisms to restrict token transfers to authorized entities only.

  • Security Audits: Conduct regular security audits of smart contracts to identify and address potential vulnerabilities proactively.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.