First Flight #21: KittyFi

Summary

The meownufactureKittyVault function in the Kitty-Fi contract uses a salt derived from the token's symbol for the create2 deployment. This approach can lead to address collisions if two tokens have the same symbol and also if this call fails or returns an unexpected value, it could disrupt the vault creation process potentially causing unexpected behaviour and security vulnerabilities.

Vulnerability Details.

The meownufactureKittyVault in the Kitty-Fi contract uses CREATE2 with a salt derived from the token's symbol as seen in the following code;

The call to ERC20(_token).symbol() may fail if the token contract does not implement the symbol() function correctly or adheres to an unexpected standard. Even if the function is implemented, the token symbol is not guaranteed to be unique across all ERC20 tokens. If two tokens have the same symbol, using their symbols as the salt for CREATE2 can result in the same contract address being generated for different tokens.

Impact

If the symbol retrieval fails or returns an identical value for different tokens, it can lead to address collisions where multiple vaults end up with the same address. Failure in the symbol retrieval process can cause the vault creation process to fail, disrupting the operational flow.

Tools Used

Manual Review

Recommendations

Instead of using the token's symbol, use a unique identifier such as the token's address concatenated with the pool address to generate the salt. Implement a fallback mechanism to handle cases where the symbol() function call fails or returns an unexpected value. Ensure the validity of the symbol retrieved and that the target address generated by CREATE2 is not already in use before deploying the KittyVault.