Submission Details
Severity:
User can deposit approved money of other users
Summary
A user can deposit money previously approved of another user.
Vulnerability Details
The problem relies on the address as a parameter.
function depositTheCrimeMoneyInATM(address account, address to, uint256 amount) external {
moneyShelf.depositUSDC(account, to, amount);
Impact
Users can provide address of another user who already approved money for this contract.
Tools Used
Manual review
Recommendations
Make this change to the code:
- function depositTheCrimeMoneyInATM(address account, address to, uint256 amount) external {
+ function depositTheCrimeMoneyInATM(address to, uint256 amount) external {
- moneyShelf.depositUSDC(account, to, amount);
+ moneyShelf.depositUSDC(msg.sender, to, amount);
}
Updates
Lead Judging Commences
n0kto about 1 year ago
Submission Judgement Published Assigned finding tags:
Arbitrary account deposit, steal approval
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.