SSSwap
First Flight #41
Beginner FriendlyRust
100 EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: medium
Invalid

Lack of Authority Validation Enables Unauthorized Transfers

shieldrey

Root + Impact

Description

  • Ideally transfer_tokens should validate that the authority signer matches the expected PDA (e.g., liquidity_pool) to prevent unauthorized token transfers.

  • Specific Issue: The function trusts the provided authority without checking it against the pool PDA, allowing malicious users to transfer tokens from pool vaults.

​
rust
​
// transfer.rs
pub fn transfer_tokens<'info>(
from: &InterfaceAccount<'info, TokenAccount>,
to: &InterfaceAccount<'info, TokenAccount>,
amount: &u64,
mint: &InterfaceAccount<'info, Mint>,
authority: &Signer<'info>,
...
) -> Result<()> {
let transfer_account_options = TransferChecked {
authority: authority.to_account_info(), // @> No PDA validation
...
};
...
}
​
​

Risk


  • Likelihood: Medium

    • Reason 1: Malicious users submit invalid authority in permissionless AMMs.

    • Reason 2: Lack of validation simplifies unauthorized transfer attempts.

  • Impact: High

    • Impact 1: Funds are stolen from pool vaults, causing direct losses.

    • Impact 2: Severe disruption of AMM operations, undermining trust.Proof of Concept

​
rust
​
// Attacker passes malicious authority
let malicious_authority = Signer::new(...);
transfer_tokens(..., &malicious_authority)?; // Transfers vault funds to attacker
​
​

Recommended Mitigation

diff
​
// transfer.rs
pub fn transfer_tokens<'info>(
...,
authority: &Signer<'info>,
...
) -> Result<()> {
+ let expected_authority = Pubkey::find_program_address(&[b"pool", pool.key().as_ref()], program_id).0;
+ require!(authority.key() == expected_authority, AmmError::InvalidAuthority);
let transfer_account_options = TransferChecked {
authority: authority.to_account_info(),
...
};
...
}
​
​
Updates

Lead Judging Commences

0xtimefliez Lead Judge 9 days ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.