Aptos Pizza Drop
Cyfrin
Beginner FriendlyGameFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Critical Authorization Bypass in `pizza_drop::get_random_slice`

parmakhanm786

Root + Impact

Public Randomness Function Allows Arbitrary Self-Registration + High Impact

Description

  • The get_random_slice() function should be an internal utility called only by authorized registration functions

  • Instead, it's exposed as a public entry point allowing any user to bypass proper registration and assign themselves random airdrop amounts

#[randomness]
entry fun get_random_slice(user_addr: address) acquires ModuleData, State { // @> Should be private/internal
let state = borrow_global_mut<State>(get_resource_address());
let time = timestamp::now_microseconds();
let random_val = time % 401;
let random_amount = 100 + random_val;
table::add(&mut state.users_claimed_amount, user_addr, random_amount); // @> Direct unauthorized registration
}

Risk

Likelihood:

  • The public entry function is discoverable and callable by any network participant

  • No authentication mechanism prevents unauthorized calls to this function

Impact:

  • Complete circumvention of the owner-controlled registration process

  • Unauthorized users can drain the airdrop pool by self-registering and claiming

Proof of Concept

// Attack sequence:
// 1. Attacker calls the exposed function directly
get_random_slice(0xattacker); // Self-registers with random amount
​
// 2. Attacker claims the unauthorized funds
claim_pizza_slice(attacker_signer); // Successfully drains contract
​
// 3. Repeat with multiple addresses to drain entire pool

Recommended Mitigation

- #[randomness]
- entry fun get_random_slice(user_addr: address) acquires ModuleData, State {
+ fun get_random_slice(user_addr: address) acquires State {
let state = borrow_global_mut<State>(get_resource_address());
let time = timestamp::now_microseconds();
let random_val = time % 401;
let random_amount = 100 + random_val;
table::add(&mut state.users_claimed_amount, user_addr, random_amount);
}
Updates

Appeal created

bube Lead Judge 10 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Anyone can call `get_random_slice` function

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.