First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

user i_kittyCoin can be burnt by any random account

cryptedoji

Summary

Since there is no verification for msg.sender in KittyPool::burnKittyCoin, any random account can call the KittyPool::burnKittyCoin function and burn all the i_kittyCoin minted by a user. This leads to the token holder not being able to redeem her collateral.

Vulnerability Details

according to the design of the protocol, The pool also handles liquidations..., hence only the KittyPool contract should be allowed to handle liquidation

Impact

  • user can be liquidated prematurely by attacker.

  • loss of collateral for users hence funds get stuck in the protocol

  • DoS attack on the protocol as users may find it difficult to redeem collaterals from the protocol, hence protocol becomes unusable

Tools Used

  • manual review

Recommendations

function burnKittyCoin(address _onBehalfOf, uint256 _ameownt) external
{
+ require(msg.sender == address(this), "NOT_AUTHORIZED_TO_BURN_TOKEN");
kittyCoinMeownted[_onBehalfOf] -= _ameownt;
i_kittyCoin.burn(msg.sender, _ameownt);
}
Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.