First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

MoneyVault::Withdraw Reverts Due to Restrictive onlyMoneyShelf Modifier in CrimeMoney::burn Function

waydou

Summary

The CrimeMoney::burn function is restricted by an onlyMoneyShelf modifier, meaning that only the MoneyShelf contract can burn CrimeMoney. However, the burn function is also called in the MoneyVault::withdraw function, causing it to revert due to the lack of the necessary role being granted to the MoneyVault in the EmergencyMigration.s.sol script.

Vulnerability Details

The MoneyVault::withdraw function relies on the CrimeMoney::burn function, which is currently restricted by the onlyMoneyShelf modifier. This modifier only allows the MoneyShelf contract to burn CrimeMoney. As the MoneyVault does not have this role, any attempt to withdraw from the MoneyVault will revert. Additionally, the revert message "CrimeMoney: only MoneyShelf can mint" is misleading when used in the context of the burn function.

Impact

The restriction causes the withdrawal functionality of the MoneyVault to be inoperative, effectively trapping all funds within the MoneyVault contract. This can lead to significant operational issues and loss of access to funds.

Tools Used

Manual Review

Recommendations

Add a new modifier onlyAuthorized

modifier onlyAuthorized() {
require(
kernel.hasRole(msg.sender, Role.wrap("moneyshelf")) || kernel.hasRole(msg.sender, Role.wrap("moneyvault")),
"CrimeMoney: only MoneyShelf or MoneyVault can perform this action"
);
_;
}

Update the CrimeMoney::burn function to use the onlyAuthorized modifier:

- function burn(address from, uint256 amount) public onlyMoneyShelf {
+ function burn(address from, uint256 amount) external onlyAuthorized {
_burn(from, amount);
}
Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

MoneyVault cannot burn or mint CrimeMoney

Godfather can add the role manually

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.