Submission Details
Severity:
Insecure access control in `Laundrette::quitTheGang` function, causing any `gangmember` can quit other gangmembers
Description
The function Laundrette::quitTheGang allows an external caller to revoke anyone's gangmember role, as long as the caller is a gangmember.
Impact
The gangmember can be revoked unvoluntarily or accidentally by someone else. The user will then lose the privileges as a gangmember, including withdrawMoney, takeGuns, etc.
Proof of Concept
function test_quitGangOthers() public {
address alice = makeAddr("alice");
joinGangGodFather();
joinGang(address(this));
assertEq(kernel.hasRole(address(this), Role.wrap("gangmember")), true);
joinGang(alice);
assertEq(kernel.hasRole(address(this), Role.wrap("gangmember")), true);
vm.prank(alice);
laundrette.quitTheGang(address(this));
assertEq(kernel.hasRole(address(this), Role.wrap("gangmember")), false);
}
Recommendations
add
isAuthorizedOrRevert(account)modifier to functionLaundrette::quitTheGang, so that only GodFather or the user itself can revoke its owngangmemberrole
Updates
Lead Judging Commences
n0kto over 1 year ago
Submission Judgement Published Assigned finding tags:
Gang members ban other members
Rewards breakdown
nSLOC
205This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.