First Flight #16: Mafia Takedown

Summary

MoneyShelf::depositUSDC uses arbitrary from in transferFrom allowing funds to transfer to an unauthorized user. Additionally the return value of transferFrom call is not checked.

Vulnerability Details

Detect when msg.sender is not used as from in transferFrom.

Impact

The attacker calls the MoneyShelf::depositUSDC while specifying the sender's address as from in transferFrom, allowing the attacker to steal the user's tokens. The attacker could also set the return value of transferFrom.

Tools Used

Slither

Recommendations

Use msg.sender as from in transferFrom. Additionally, use SafeERC20, or ensure that the transferFrom return value is checked.