First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Godfather is not initially added to the gang members

kostov

Summary

Godfather is not initially added to the gang members which prevents him from calling some of the Laundrette.sol functions

Vulnerability Details

All the functions in Laundrette.sol which have the onlyRole("gangmember") modifier can't be called by the godfather as they will revert, because he doesn't have the gangmember role.

There is a way around this, but not without a cost:

1. the godfather will have to revoke the admin rights from `Laundrette.sol` to himself

2. then call `Kernel::grantTole`

3. give the admin rights back to `Laundrette.sol`.

Making these 3 transactions will be gas costly.

To test the result paste these tests in Laundrette.t.sol:

function test_godFatherCannotWithdraw() public {
vm.prank(godFather);
usdc.approve(address(moneyShelf), 100e6);
laundrette.depositTheCrimeMoneyInATM(godFather, godFather, 100e6);
assertEq(usdc.balanceOf(address(moneyShelf)), 100e6);
assertEq(crimeMoney.balanceOf(godFather), 100e6);
​
vm.expectRevert();
laundrette.withdrawMoney(godFather, godFather, 100e6);
}
​
function test_godFatherCannotAddToGang() public {
vm.prank(godFather);
​
vm.expectRevert();
laundrette.addToTheGang(address(this));
}

Impact

Unnecessary gas will be spent.

Tools Used

Manual Review

Recommendations

Grant the gangmember role to the godfather in the Deployer.s.sol contract:

function deploy() public returns (Kernel, IERC20, CrimeMoney, WeaponShelf, MoneyShelf, Laundrette) {
godFather = msg.sender;
​
// Deploy USDC mock
HelperConfig helperConfig = new HelperConfig();
IERC20 usdc = IERC20(helperConfig.getActiveNetworkConfig().usdc);
​
Kernel kernel = new Kernel();
CrimeMoney crimeMoney = new CrimeMoney(kernel);
​
WeaponShelf weaponShelf = new WeaponShelf(kernel);
MoneyShelf moneyShelf = new MoneyShelf(kernel, usdc, crimeMoney);
Laundrette laundrette = new Laundrette(kernel);
​
kernel.grantRole(Role.wrap("moneyshelf"), address(moneyShelf));
+ kernel.grantRole(Role.wrap("gangmember"), address(godfather));
Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

GodFather is not a gang member

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.