Submission Details
Severity:
Adding a Role check to `Laundrette::putGunsInTheSuspendedCeiling` function ensures that weapons stay in the gang
Description
godFather assigns weapons to GangMembers using the Laundrette::putGunsInTheSuspendedCeiling function but with no role checks there is a possibility that weapons may be assigned to non gangmembers
Impact
Weapons may be improperly assigned leading to discrepancies
Proof of Concept
No checks for account's Role in the function
Poc
function test_DepositGunsNoAddressZeroCheck() public {
vm.prank(godFather);
laundrette.putGunsInTheSuspendedCeiling(address(0), 3);
}
Recommended Mitigation
make the following changes in the function to mitigate the issue
function putGunsInTheSuspendedCeiling(address account, uint256 amount) external isGodFather {
+ require(kernel.hasRole(account, Role.wrap("gangmember")), "Account doesn't Belong to a GangMember");
weaponShelf.deposit(account, amount);
}
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.