First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Lack of Validation for `KittyCoin::mint` and `KittyCoin::burn` Functions

mishraji874

Description: The absence of validation checks for addresses and amounts in the KittyCoin::mint and KittyCoin::burn functions could allow the KittyPool contract to mint tokens to or burn tokens from unintended or zero addresses, leading to potential token mismanagement or loss.

Impact: Token mismanagement, potential loss or locking of tokens in zero addresses.

Proof of Concept: An attacker could potentially call these functions with zero addresses, leading to loss of tokens:

contract AttackKittyCoin {
KittyCoin public kittyCoin;
​
constructor(address _kittyCoin) {
kittyCoin = KittyCoin(_kittyCoin);
}
​
function attackMint() public {
// Mint tokens to the zero address
kittyCoin.mint(address(0), 1000);
}
​
function attackBurn() public {
// Burn tokens from the zero address
kittyCoin.burn(address(0), 1000);
}
}

Recommended Mitigation: Add validation checks to ensure that addresses are non-zero and amounts are greater than zero.

function mint(address _to, uint256 _amount) external onlyKittyPool {
require(_to != address(0), "Invalid address");
require(_amount > 0, "Invalid amount");
_mint(_to, _amount);
}
​
function burn(address _from, uint256 _amount) external onlyKittyPool {
require(_from != address(0), "Invalid address");
require(_amount > 0, "Invalid amount");
_burn(_from, _amount);
}
​
Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.