Submission Details
Severity:
`TempleGold::_update` whitelist check is not correct
Summary
Whitelisted users can send tokens to anyone, not only to other whitelisted addresses
Vulnerability Details
TempleGold::_update check if sender and receiver are authorized, and revert only of both are not, but should revert if at least one of them is not authorized:
if (!authorized[from] && !authorized[to]) { revert ITempleGold.NonTransferrable(from, to); }
Which means if user is authorized, it does not matter how is receiver, it will pass the check
Impact
Users can send tokens to not authorized users
Tools Used
Manual review
Recommendations
- if (!authorized[from] && !authorized[to]) { revert ITempleGold.NonTransferrable(from, to); }
+ if (!authorized[from] || !authorized[to]) { revert ITempleGold.NonTransferrable(from, to); }
Prize pool breakdown
Total prize
25,000 USDC
nSLOC
99825 USDC / LOC
20,000 USDC
2,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.