First Flight #16: Mafia Takedown

Summary

Anyone can frontrun ERC20 approve mechanism preventing gang members from withdrawing money.

Vulnerability Details

This attack scenario is a MEV bot attack, and here's how it can happen:
-step 1: A gang member approves the MoneyShelf for x amount of usdc
-step 2: attacker calls depositTheCrimeMoneyInATM(gangMember, msg.sender, x)
-final state: - gang member has x amount of usdc transfered from his address to the moneyShelf
- attacker gets x amount of CrimeMoney and his balance is updated
- gang member doesn't get CrimeMoney, hence noway for him to withdraw x usdc, his bank mapping was not updated, he cannot burn, withdrawUSDC will fail

Impact

gang member cannot withdraw money and attacker gets crimeMoney for free

Tools Used

Manual review

Recommendations

Fix the bug, you might want to use approve in the contract, or maybe opt for ERC777 instead of ERC20