DatingDapp
AI First Flight #6
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: high
Likelihood: high
Invalid

Approval State Manipulation Through Transaction Array Growth

wanzablock

Root + Impact

Description

  • Describe the normal behavior in one or more sentences

  • The contract uses array indices to reference transactions

  • Explain the specific issue or problem in one or more sentences

  • Wrong transaction executed

​
function approveTransaction(uint256 _txId) external onlyOwners {
require(_txId < transactions.length, "Invalid transaction ID");
Transaction storage txn = transactions[_txId];
// Owner thinks they're approving transaction to Alice
// But malicious co-owner front-runs with transaction to themselves
// Original txId shifts in user's mental model
}// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  • Medium to high risk

  • Reason 2

Impact:

  • Impact 1

  • Owners may unknowingly approve malicious transactions

  • Front-running risk during transaction creation

  • Impact 2

Proof of Concept

struct Transaction {
address to;
uint256 value;
bytes32 description; // keccak256("Payment to Alice for services")
bool approvedByOwner1;
bool approvedByOwner2;
bool executed;
}

Recommended Mitigation

- remove this code
+ add this code
function approveTransaction(
uint256 _txId,
address _expectedTo,
uint256 _expectedValue
) external onlyOwners {
require(_txId < transactions.length, "Invalid transaction ID");
Transaction storage txn = transactions[_txId];
// Verify transaction details match expectations
require(txn.to == _expectedTo, "Transaction recipient mismatch");
require(txn.value == _expectedValue, "Transaction value mismatch");
require(!txn.executed, "Transaction already executed");
// ... approval logic
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 2 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!