Replay Attack Vulnerability in depositTokens Function
Summary
The depositTokens function generates a unique request hash but does not store it in the contract's state. This omission opens the possibility for replay attacks, where an attacker could resubmit the same transaction multiple times, leading to unauthorized token transfers or double deposits.
Impact
Double Deposits: The same transaction could be processed more than once.
Unauthorized Transactions: Malicious actors could exploit this to perform unintended actions.
Recommendation
Store the hash of each processed request in a mapping
Lead Judging Commences
invalid-replay-attack-hash-not-stored-nonce-not-used
There is no impact here: Transaction cannot be replayed because the blockchain use the nonce in the signature. Hash is computed on-chain. Using or trying to have the same hash mean you need to buy the token, and they will be sent to their origin owner. Why an attacker would buy tokens to give them back ? No real impact.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.