First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Every deposit is tracked

_frolic

Summary

The Shelf contract which is inherited by both MoneyVault and MoneyShelf contract keeps track of every deposit using the bank mapping.

Vulnerability Details

The Shelf contract is an abstract contract inherited by both MoneyVault and MoneyShelf and it keeps track of every deposit made using the bank mapping and uses it in the withdraw function hence a gangMember or the godFather can only withdraw as much as they deposit.

Impact

The contract allows anyone to deposit but only allows the godFather and gangMembers to withdraw but due to the bank mapping that only allows withdrawal on as much as has been deposited, the gangMembers and the godFather will only be able to withdraw as much as they deposited which means anyone who isn't the godFather or gangMembers and deposits, their funds cannot be withdrawn leading to it being stuck in the contract.

Proof of Concept

Code
function test_godfatherCantWithdrawUserTokens() public {
vm.startPrank(godFather);
usdc.transfer(user, 100e6);
vm.stopPrank();
uint godFatherStartingBalance = usdc.balanceOf(godFather);
vm.startPrank(user);
usdc.approve(address(moneyShelf), 100e6);
laundrette.depositTheCrimeMoneyInATM(user, user, 100e6);
vm.stopPrank();
assertEq(usdc.balanceOf(user), 0);
assertEq(usdc.balanceOf(address(moneyShelf)), 100e6);
assertEq(crimeMoney.balanceOf(user), 100e6);
​
joinGang(address(0));
vm.startPrank(godFather);
// --------------Reverts----------------------
laundrette.withdrawMoney(godFather, godFather, 100e6);
assertEq(usdc.balanceOf(godFather), godFatherStartingBalance);
assertEq(usdc.balanceOf(address(moneyShelf)), 0);
assertEq(crimeMoney.balanceOf(godFather), 0);
}

Tools Used

Manual Analysis

Recommendations

One way of addressing this could be by using different deposit functions for users (which doesn't track their deposits), gangMembers and the godFather such that the godFather can withdraw any amount of tokens avaliable at any given time.

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.