First Flight #16: Mafia Takedown

Summary

Bad access control preventing the godfather from taking guns, withdrawing USDC or adding members to the gang.

Vulnerability Details

Godfather was never attributed the role of "gangmember", at deployment, the godfather does not have the role "gangmember". Thus all functions in the Laundrette that use the modifier onlyRole("gangmember") along with isGodFather or isAuthorizedOrRevert(account) will revert if the caller is the godfather. He cannot add himself to the gang. He could try and call retrieveAdmin to set himself as the admin but the call would revert because of the onlyExecutor modifier that prevents executeAction from being called by any address other than that of the godfather (in that case the Laundrette's call that is the admin will revert). The godfather has to jump through hoops in order to have the access rights he should have, he can directly call executeAction to be the admin, call grantRole to grant himself the role of "gangmember".

Here's the functions that have that bad access control:

Here's the function that will always revert and thus is useless:

Impact

Godfather cannot take guns, withdraw USDC or add members to the gang without taking the admin role from the laundrette

Tools Used

Manual review

Recommendations

Fix the bug.