First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

Godfather cannot access functions reserved for gangmembers, as `Deployer` does not grant him the role

paprikrumplikas

Summary

The godfather lacks the role gangmember and, hence, cannot access functions reserved for gangmembers:

  • Laundrette::withdrawMoney,

  • Laundrette::takeGuns,

  • Laundrette::addToTheGang,

  • Laundrette::quitTheGang

Vulnerability Details

Deployer misses to assign the gangmember role to the godfather, who cannot assign the role to himself for the following reasons:

  • Laundrette::addToTheGang is gated by the onlyRole("gangmember") modifier,

  • kernel.grantRole() is gated by the onlyAdmin modifier, and the admin rights for Kernel are possessed by Laundrette, not by the godfather. As described in another finding, these rights cannot be reclaimed by the godfather.

Impact

While in theory godfather is supposed to have all rights and control the protocol, in practice, he cannot access most of the functions:

  • Laundrette::withdrawMoney,

  • Laundrette::takeGuns,

  • Laundrette::addToTheGang,

  • Laundrette::quitTheGang

Tools Used

Manual review, Foundry.

Recommendations

The clearest solution is to grant the gangmember role for the godfather from the get-go, i.e. in Deployer:

function deploy() public returns (Kernel, IERC20, CrimeMoney, WeaponShelf, MoneyShelf, Laundrette) {
godFather = msg.sender;
​
// Deploy USDC mock
HelperConfig helperConfig = new HelperConfig();
IERC20 usdc = IERC20(helperConfig.getActiveNetworkConfig().usdc);
​
Kernel kernel = new Kernel();
CrimeMoney crimeMoney = new CrimeMoney(kernel);
​
WeaponShelf weaponShelf = new WeaponShelf(kernel);
MoneyShelf moneyShelf = new MoneyShelf(kernel, usdc, crimeMoney);
Laundrette laundrette = new Laundrette(kernel);
​
kernel.grantRole(Role.wrap("moneyshelf"), address(moneyShelf));
​
kernel.executeAction(Actions.InstallModule, address(weaponShelf));
kernel.executeAction(Actions.InstallModule, address(moneyShelf));
kernel.executeAction(Actions.ActivatePolicy, address(laundrette));
​
+ kernel.grantRole(Role.wrap("gangmember"), godFather);
​
​
kernel.executeAction(Actions.ChangeAdmin, address(laundrette));
kernel.executeAction(Actions.ChangeExecutor, godFather);
​
return (kernel, usdc, crimeMoney, weaponShelf, moneyShelf, laundrette);
}

Additionally, consider removing the onlyRole("gangmember") modifier from Laundrette::addToTheGang, as the other modifier is stricter and does the job in itself:

- function addToTheGang(address account) external onlyRole("gangmember") isGodFather {
+ function addToTheGang(address account) external isGodFather {
​
kernel.grantRole(Role.wrap("gangmember"), account);
}
Updates

Lead Judging Commences

n0kto Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

GodFather is not a gang member

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.