Submission Details
Severity:
Malicious user will steal money from other user
Summary
In RToken.solin transferFrom function Malicious user will give sender address as user address and recipient address as own address. Using this malicious user will be able to steal money from other user.
Vulnerability Details
In RToken.solin transferFrom function Malicious user will give sender address as user address and recipient address as own address. Using this malicious user will be able to steal money from other user.
function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}
Impact
Users will lost his own money.
Tools Used
Manual review
Recommendations
In RToken.solin transferFrom function use sender address equal to msg.sender
function transferFrom(address sender, address recipient, uint256 amount) public override(ERC20, IERC20) returns (bool) {
+ // Logic for sender = msg.sender or not ? if not then revert
uint256 scaledAmount = amount.rayDiv(_liquidityIndex);
return super.transferFrom(sender, recipient, scaledAmount);
}
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.