Submission Details
Impact:
Likelihood:
No Access Control on fund_pizza_drop
Root + Impact
Description
fund_pizza_drop can be called by anyone if owner check bypassed.
coin::transfer<AptosCoin>(owner, resource_addr, amount); // @> called without proper ownership check
Risk
Likelihood:
Non-owner funds can be sent or maliciously misused.
Impact:
-
Contract receives unauthorized funds.
-
Could disrupt accounting.
Proof of Concept
// Any user calls fund_pizza_drop with arbitrary amount
Recommended Mitigation
+ assert!(signer::address_of(owner) == state.owner, E_NOT_OWNER);
- coin::transfer<AptosCoin>(owner, resource_addr, amount);
+ coin::transfer<AptosCoin>(owner, resource_addr, amount);
Rewards breakdown
nSLOC
125This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.