First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Any gangmember can remove gangmember role for any other member

octeezy

Summary

Any user with role "gangmember" can call the function quitTheGang passing the account of any other gangmember

Vulnerability Details

Any user with gangmenber role can keep forcing to quit other gangmember users due to a lack of access control in the quitGang function.

Impact

HIGH - Denial of service, malicious user can remove users from gang, including the godFather, making godFather unable to use some of the functionality.

Tools Used

Foundry test:

function testOtherGangMembersCanQuitYou() public {
vm.prank(kernel.admin());
kernel.grantRole(Role.wrap("gangmember"), godFather);
vm.prank(godFather);
laundrette.addToTheGang(gm1);
vm.prank(gm1);
laundrette.quitTheGang(godFather);
vm.prank(godFather);
vm.expectRevert();
laundrette.addToTheGang(gm2);
}

Recommendations

Add a check to verify that the account being passed is the same as msg.sender, or depending on the expected functionality add the isAuthorizedOrRevert modifier to the quitTheGang function.

Updates

Lead Judging Commences

n0kto Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Gang members ban other members

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.