First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

`MoneyVault.sol` Does not carry over the balance stored in the `MoneyShelf.sol` Contract

coffee

Summary

Once the EmergencyMigration.s.sol is run to migrate from the MoneyShelf.sol contract to the MoneyVault.sol contract. The balance's stored in MoneyShelf.sol are not transferred over to MoneyVault.sol to be protected.

Vulnerability Details

As per the documentation, the money from MoneyShelf.sol is to be protected inside of the MoneyVault.sol contract once the Emergency Migration occurs. This does not work though because the money will still be inside of the MoneyShelf.sol contract.

Impact

Because the MoneyValue.sol contract cannot be deposited to and it does not hold any value, it is essentially useless once the Emergency Migration occurs.

The below test fails showing that the value deposited into the MoneyShelf.sol contract is not transferred over to MoneyVault.sol.

function test_migrateDepositVaultValue() public {
vm.prank(godFather);
usdc.transfer(address(this), 100e6);
usdc.approve(address(moneyShelf), 100e6);
laundrette.depositTheCrimeMoneyInATM(address(this), address(this), 100e6);
assertEq(usdc.balanceOf(address(this)), 0);
assertEq(usdc.balanceOf(address(moneyShelf)), 100e6);
assertEq(crimeMoney.balanceOf(address(this)), 100e6);
​
assertEq(address(kernel.getModuleForKeycode(Keycode.wrap("MONEY"))), address(moneyShelf));
​
EmergencyMigration migration = new EmergencyMigration();
MoneyVault moneyVault = migration.migrate(kernel, usdc, crimeMoney);
​
assertNotEq(address(moneyShelf), address(moneyVault));
assertEq(address(kernel.getModuleForKeycode(Keycode.wrap("MONEY"))), address(moneyVault));
​
assertEq(usdc.balanceOf(address(moneyVault)), 100e6);
}

Tools Used

--Foundry

Recommendations

It is recommended to re-work how the emergency migration to the MoneyVault.sol occurs. It would be best to transfer the money to this contract during the migration.

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Emergency migration leave the USDC

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.