Submission Details
Severity:
Gang members modifier as access control to the `addToTheGang` function.
Summary
Modifier onlyRole (“gangmember”) in the addToTheGang function
Vulnerability Details
From the documentation adding new members is not among the functions allowed to gang members
GodFather: Owner, has all the rights.
GangMember:
Deposit USDC and withdraw USDC in exchange for CrimeMoney
Transfer CrimeMoney between members and godfather.
Take weapons that GodFather assigned to the member.
External users: can only call view functions and deposit USDC.
Impact
Only the Godfather should be able to add all new gang members.
Tools Used
Manual review
Recommendations
Make this change to the code:
- function addToTheGang(address account) external onlyRole("gangmember") isGodFather {
+ function addToTheGang(address account) external isGodFather {
kernel.grantRole(Role.wrap("gangmember"), account);
}
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.