Token-0x
First Flight #54
Beginner FriendlyDeFi
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

No overflow protection in `_burn` function.

0x6a70

Root + Impact

Root cause is that assmebly does not have protection for undeflow/overflow meaning when you burn more than balance it underflows and user has a balance of (almost) infinite tokens.

Description

  • Solidity has a protection for underflow and overflow but assembly not.

// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Very high , easily doable, just need to burn some amount that is higher than balance of the account.

Impact:

  • High , user can get infinite tokens.

Proof of Concept

This test will fail the assertion assertEq(balance, 0);

function test_burnTooMuchReverts() public {
uint256 amount = 100e18;
address account = makeAddr("account");
token.mint(account, amount);
​
uint256 balance = token.balanceOf(account);
assertEq(balance, amount);
assertEq(token.totalSupply(), amount);
​
token.burn(account, 101e18);
balance = token.balanceOf(account);
console.log("Balance after burning too much:", balance);
assertEq(balance, 0);
assertEq(token.totalSupply(), 0);
}

Recommended Mitigation

Too fix the problem , a check must be introduced to see if there is enough balance for the user to burn.

function _burn(address account, uint256 value) internal {
assembly ("memory-safe") {
if iszero(account) {
mstore(0x00, shl(224, 0x96c6fd1e))
mstore(add(0x00, 4), 0x00)
revert(0x00, 0x24)
}
​
let ptr := mload(0x40)
let balanceSlot := _balances.slot
let supplySlot := _totalSupply.slot
​
let supply := sload(supplySlot)
sstore(supplySlot, sub(supply, value))
​
mstore(ptr, account)
mstore(add(ptr, 0x20), balanceSlot)
​
let accountBalanceSlot := keccak256(ptr, 0x40)
let accountBalance := sload(accountBalanceSlot)
+ if lt(accountBalance, value) {
+ mstore(0x00, shl(224, 0xe450d38c))
+ mstore(add(0x00, 4), account)
+ mstore(add(0x00, 0x24), accountBalance)
+ mstore(add(0x00, 0x44), value)
+ revert(0x00, 0x64)
+ }
sstore(accountBalanceSlot, sub(accountBalance, value))
}
}
Updates

Lead Judging Commences

gaurangbrdv Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

overflow & underflow

missing checks for overflow and underflow.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!