First Flight #16: Mafia Takedown

Summary

A vulnerability was found in the depositTheCrimeMoneyInATM function of the Laundrette smart contract, where the function allows deposits on behalf of any account without verification, potentially leading to misuse and unauthorized actions.

Vulnerability Details

The depositTheCrimeMoneyInATM function is designed to facilitate deposits of USDC into the moneyShelf module. The function takes three parameters: account, to, and amount. The current implementation allows the account parameter to be specified by the caller without any checks or restrictions:

In this implementation, the account parameter is used directly in the moneyShelf.depositUSDC call, which means that any caller can specify any account for depositing funds. This can lead to potential misuse where unauthorized users can deposit funds on behalf of others, possibly causing tracking issues and unauthorized activities.

Impact

The main impacts of this vulnerability are:

1. Unauthorized Deposits: Any user can deposit USDC on behalf of another user without their consent, leading to potential misuse.

2. Accountability Issues: Tracking the actual source of deposits becomes challenging as the actual depositor is not verified.

3. Potential Exploits: Malicious actors could exploit this behavior to manipulate account balances, possibly leading to further financial discrepancies or unauthorized financial actions.

Tools Used

Manual code review

Recommendations

To mitigate this vulnerability, the function should be modified to use msg.sender as the depositor, ensuring that only the caller can deposit on their behalf. The corrected implementation should be:

This modification ensures that the account parameter is always the address of the caller (msg.sender), thereby preventing unauthorized users from depositing on behalf of other accounts.

Corrected Function

By implementing this change, the function will maintain the integrity of deposit actions, ensuring that only authorized users can deposit USDC on their own behalf, thus improving the security and reliability of the Laundrette smart contract.