First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Upgrade does not disable

_frolic

Summary

The Kernel upgrades the MoneyShelf to MoneyVault but doesn't disable the MoneyShelf contract.

Vulnerability Details

When the Kernel contract upgrades/migrates the MoneyShelf module to MoneyVault it doesn't disable the functions and functionality of the MoneyShelf module.

Impact

After the migration anyone can still deposit into the MoneyShelf contract and gangmembers can still still withdraw their funds from the MoneyShelf contract.

Proof of Concept

Code
function test_moveFundsWhenMigrating2() public {
joinGang(address(0));
uint256 godFatherStartingBal = usdc.balanceOf(godFather);
vm.startPrank(godFather);
usdc.approve(address(moneyShelf), 500e6);
laundrette.depositTheCrimeMoneyInATM(godFather, godFather, 250e6);
laundrette.depositTheCrimeMoneyInATM(godFather, godFather, 250e6);
assertEq(usdc.balanceOf(godFather), godFatherStartingBal - 500e6);
assertEq(usdc.balanceOf(address(moneyShelf)), 500e6);
assertEq(crimeMoney.balanceOf(godFather), 500e6);
vm.stopPrank();
​
EmergencyMigration migration = new EmergencyMigration();
MoneyVault moneyVault = migration.migrate(kernel, usdc, crimeMoney);
​
assertEq(address(kernel.getModuleForKeycode(Keycode.wrap("MONEY"))), address(moneyVault));
assertNotEq(usdc.balanceOf(address(moneyVault)), 500e6);
​
vm.startPrank(godFather);
laundrette.withdrawMoney(godFather, godFather, 500e6);
vm.stopPrank();
​
assertEq(usdc.balanceOf(godFather), godFatherStartingBal);
}

Tools Used

Recommendations

A boolean variable that keeps track of whether the module MoneyShelf has been upgraded or is active and when it has been upgraded it will disable deposits and withdrawals from the MoneyShelf contract could be used.

Updates

Lead Judging Commences

n0kto Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.