Lack of Access Control on `sendProfit` Function in `MembershipERC1155`
-
Root Cause:
The
sendProfitfunction is declared asexternalwithout any access control modifiers, allowing any address to invoke it.function sendProfit(uint256 amount) external {uint256 _totalSupply = totalSupply;if (_totalSupply > 0) {totalProfit += (amount * ACCURACY) / _totalSupply;IERC20(currency).safeTransferFrom(msg.sender, address(this), amount);emit Profit(amount);} else {IERC20(currency).safeTransferFrom(msg.sender, creator, amount); // Redirect profit to creator if no supply}} -
Impact:
Profit Manipulation: Unauthorized users can manipulate
totalProfit, affecting profit distribution logic.Denial of Service (DoS): Spamming the
sendProfitfunction can lead to increased gas consumption and potential DoS.Financial Exploits: If
sendProfitis used to distribute funds, unauthorized manipulation can lead to incorrect or fraudulent distributions.
-
Recommendation:
-
Implement Access Control: Restrict the
sendProfitfunction to authorized roles (e.g.,ADMIN_ROLEor a designated profit distributor role).function sendProfit(uint256 amount) external onlyRole(PROFIT_DISTRIBUTOR_ROLE) {// Function logic} -
Validate Inputs: Ensure that the
amountbeing sent adheres to expected constraints to prevent manipulation.
-
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.