Submission Details
Severity:
Arbitrary `account` in `moneyShelf::usdc.transferFrom`
Summary
Arbitrary account in moneyShelf::usdc.transferFrom
Vulnerability Details
if attacked approves this contract to spend his/her USDC tokens. Attacker can call a and specify attacked's address as the from/account parameter in transferFrom, allowing him/her to transfer attacked's tokens to moneyShelf contract.
Impact
Attacked risks having all its USDC drained.
Tools Used
Manual review
Recommendations
Use msg.sender as from/account in transferFrom.
// "permissioned" already used by Shelf functions
- function depositUSDC(address account, address to, uint256 amount) external {
+ function depositUSDC(address to, uint256 amount) external {
deposit(to, amount);
- usdc.transferFrom(account, address(this), amount);
+ usdc.transferFrom(msg.sender, address(this), amount);
crimeMoney.mint(to, amount);
}
Updates
Lead Judging Commences
n0kto about 1 year ago
Submission Judgement Published Assigned finding tags:
Arbitrary account deposit, steal approval
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.