First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Lack of kittyCoin eligibility and sufficiency check on `KittyPool:burnKittyCoin`

soupy

Summary

There is no checks on both user (whose kittyCoin gets burnt on behalf) and executor (player to call the burnKittyCoin function) collateral eligibility in KittyPool:burnKittyCoin . If either user or executor doesn't have the required kittyCoin amount, the function will revert.

Vulnerability Details

In other core transactional functions in KittyPool contract, there are either modifier or prerequisite checks with customed error implemented to prevent subsequent operation to go through if the conditions are not met. However for function KittyPool:burnKittyCoin, there is no prerequisite check if either the user or executor does own KittyCoin and if the kittyCoin amount they hold is sufficient.

​
function burnKittyCoin(address _onBehalfOf, uint256 _ameownt) external {
// no prerequisite check on `_onBehalfOf` and `msg.sender` kittyCoin eligibility and sufficiency !!
kittyCoinMeownted[_onBehalfOf] -= _ameownt;
i_kittyCoin.burn(msg.sender, _ameownt);
}

When either user or executor doesn't have the required kittyCoin amount, the function will revert as demonstrated in the test below:

function test_audit_burnKittyCoin_kittyCoinEligibilitySufficiency() public {
address executor = makeAddr("executor");
deal(weth, executor, AMOUNT);
​
uint256 amountToMint = 20e18;
​
vm.startPrank(user);
IERC20(weth).approve(address(wethVault), 5 ether);
kittyPool.depawsitMeowllateral(weth, 5 ether);
kittyPool.meowintKittyCoin(amountToMint);
vm.stopPrank();
​
// scenario that executor doesn't have the kittyCoin
vm.startPrank(executor);
IERC20(weth).approve(address(wethVault), 5 ether);
kittyPool.depawsitMeowllateral(weth, 5 ether);
​
vm.expectRevert();
kittyPool.burnKittyCoin(user, amountToMint);
vm.stopPrank();
​
// scenario that user doesn't have the amount of kittyCoin exeecutor wants to burn
vm.startPrank(executor);
IERC20(weth).approve(address(wethVault), 5 ether);
kittyPool.depawsitMeowllateral(weth, 5 ether);
kittyPool.meowintKittyCoin(amountToMint);
​
vm.expectRevert();
kittyPool.burnKittyCoin(user, amountToMint * 2);
vm.stopPrank();
​
}
​

This could have impacted other processes that depend on this output's state to show the correct error messsage or notification

Impact

Unclear error message with function to revert due to no kittyCoin eligibility and sufficiency check

Tools Used

Manual review and forge test

Recommendations

To include prerequisite check on both user and executor if they hold any kittyCoin and if the amount is sufficient for the function call

​
function burnKittyCoin(address _onBehalfOf, uint256 _ameownt) external {
+ require(_hasEnoughKittyCoin(_user) && _hasEnoughKittyCoin(msg.sender), KittyPool__NotEnoughKittyCoinPurrrr());
kittyCoinMeownted[_onBehalfOf] -= _ameownt;
i_kittyCoin.burn(msg.sender, _ameownt);
}
Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.