Submission Details
Severity:
EveryOne can deposit in the MoneyVault
Summary
Everyone can deposit in MoneyVault
Vulnerability Details
As the ReadMe said:
In case of any issue (on-chain or off-chain), MoneyShelf is updated to this contract to protect the money from the justice system or any other gang.
Only the GodFather can withdraw and no one can deposit in this contract.
But actually everyone can deposit in the Vault contract.
Here is the POC:
function test_migrate() public {
assertEq(address(kernel.getModuleForKeycode(Keycode.wrap("MONEY"))), address(moneyShelf));
EmergencyMigration migration = new EmergencyMigration();
MoneyVault moneyVault = migration.migrate(kernel, usdc, crimeMoney);
assertNotEq(address(moneyShelf), address(moneyVault));
assertEq(address(kernel.getModuleForKeycode(Keycode.wrap("MONEY"))), address(moneyVault));
console.log("BalanceOfVault", usdc.balanceOf(address(moneyVault)));
deal(address(usdc), hacker, 1e18);
vm.prank(hacker);
IERC20(usdc).transfer(address(moneyVault), 1e18);
console.log("BalanceOfVaultAfter", usdc.balanceOf(address(moneyVault)));
}
Impact
Tools Used
Manual review, Foundry.
Recommendations
Override ERC20 transfer function
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.