Submission Details
Severity:
Interactions overwrites as multiple interactions happens on the same target contract.
Description
`InheritanceManager::contractInteractions` function overright the data of interactions in the mapping.
```javascript
function contractInteractions(address _target, bytes calldata _payload, uint256 _value, bool _storeTarget)
external
nonReentrant
onlyOwner
{
// waht if user has not appropriate fallback or receive function?
//also what if user has not enough money?
//zero address ? and zero amount?
(bool success, bytes memory data) = _target.call{value: _value}(_payload);
require(success, "interaction failed");
if (_storeTarget) {
@> interactions[_target] = data;
```
Assume the senario for multiple transactions. Call any function on the target contract as there is no machanism for map data isolate the data will be overwrites.
Impact
Beneficiary or the owner will loss the interaction data history as they have only present data.
Proof of Concept
Let's create a senario
1. Owner will perform interactions on ERC20 contract
2. Owner mint tokens so the minting token data will store in `interactions` mapping. (eg. data = xyz).
3. Now the owner send some tokens to his friend therefore the new data will be store in `interactions` mapping. (eg. data = abc)
- Now after `90` days if anybineficiary tries to get the data history then they will only able to get latest data because the data has been overwrited.
Recommended Mitigation
the wallet should have multi dimentional mapping for the specific target address and the performed data.
add following mapping in the contract file.
```javascript
mapping (address => mapping(uint256 => bytes)) interactions;
```
also change the corresponding mapping where it has been used.
Rewards breakdown
nSLOC
211This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.