Submission Details
Severity:
Gang members can force each other to quit the gang at any time
Summary
Gang members can make other members to quit the gang when they want through the quitTheGang function.
Vulnerability Details
There is a wrong modifier of the quitTheGang function, allowing all gang members to use it even if they shouldn’t.
function quitTheGang(address account) external onlyRole("gangmember") {
kernel.revokeRole(Role.wrap("gangmember"), account);
}
Impact
A gang member could be forced to quit the gang only due to another member.
Tools Used
Manual review
Recommendations
Change the code in this way:
- function quitTheGang(address account) external onlyRole("gangmember") {
+function quitTheGang(address account) external onlyRole("gangmember") isAuthorizedOrRevert(account) {
kernel.revokeRole(Role.wrap("gangmember"), account);
}
Updates
Lead Judging Commences
n0kto about 1 year ago
Submission Judgement Published Assigned finding tags:
Gang members ban other members
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.