Submission Details
Severity:
No check for non-contract addresses in `MembershipERC1155::callExternalContract`
Description: The external call in MembershipERC1155::callExternalContract did not check if the address passed in is a contract address or not.
Impact: Funds could mistakenly be sent to an externally owned address.
Recommended Mitigation: Add the following function to the MembershipERC1155 and MembershipFactory contract:
function isContract(address addr) internal view returns (bool) {
uint256 codeSize;
assembly {
codeSize := extcodesize(addr)
}
return codeSize > 0;
}
Now update the function as follows:
function callExternalContract(address contractAddress, bytes memory data) external payable onlyRole(OWP_FACTORY_ROLE) returns (bytes memory ) {
+ require(isContract(contractAddress), "Address is not a contract");
(bool success, bytes memory returndata) = contractAddress.call{value: msg.value}(data);
require(success, "External call failed");
return returndata;
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.