First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Not Deactivating `Laundrette` policy allows users to access `MoneyShelf` even after `EmergencyMigration`

codexbugmenot

Description

After the EmergencyMigration the protocol is expected to have either a new policy or the Laundrette policy pointing to MoneyVault and not MoneyShelf both require the Laundrette policy to be deactivated after the migration else users can access MoneyShelf even after migration

Impact

During the emergency period only the godFather should be able to withdraw funds and no deposits are allowed but if Laundrette policy is not deactivated any GangMember can withdraw their funds and any external user can still deposit

Proof of Concept

PoC: Users can access MoneyShelf even after EmergencyMigration
​
function test_useMoneyShelfAfterMigrate() public {
joinGang(address(this));
​
EmergencyMigration migration = new EmergencyMigration();
(MoneyVault moneyVault, Emergency emergency) =
migration.migrate(kernel, usdc, crimeMoney, laundrette, moneyShelf);
​
vm.prank(godFather);
usdc.transfer(address(this), 100e6);
usdc.approve(address(moneyShelf), 100e6);
​
// After Migration this should fail , but it doesnt since laundrette policy is not deactivated
laundrette.depositTheCrimeMoneyInATM(address(this), address(this), 100e6);
​
// After Migration this should fail , but it doesnt since laundrette policy is not deactivated
laundrette.withdrawMoney(address(this), address(this), 100e6);
​
assertEq(usdc.balanceOf(address(this)), 100e6);
}
​

Recommended Mitigation

Deactivate Laundrette policy in EmergencyMigration.s.sol's EmergencyMigration::migrate function .

Make the following changed in EmergencyMigration.s.sol's EmergencyMigration::migrate function
at the end

......
....
..
+ kernel.executeAction(Actions.DeactivatePolicy, address(laundrette));
​
// this can be address(emergency) for new policy
// or can be address(laundrette) effectively reactivating laundrette
kernel.executeAction(Actions.ActivatePolicy, address(emergency));
//
vm.stopBroadcast();
return (moneyVault, emergency);
}
Updates

Lead Judging Commences

n0kto Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.