First Flight #21: KittyFi

Summary

The KittyCoin::burnKittyCoin() function allows to reduce the kittyCoinMeownted balance on-behalf of an account different that who is calling, allowing the on-behalf account keep owning the KittyCoins and the caller keep having the kittyCoinMeownted balance.

Vulnerability Details

The KittyCoin::burnKittyCoin() function allows to reduce the kittyCoinMeownted balance on-behalf of an account different that who is calling, allowing the on-behalf account keep owning the KittyCoins and the caller keep having the kittyCoinMeownted balance.

Therefore the on-behalf user can use their KittyCoins outside of the KittyPool contract context and the caller user will be able to take advantage of the kittyCoinMeownted inside of the contract.

Tools Used

Manual review

Recommendations

Consider to remove the option of burn KittyCoin on-behalf of another account.