code-423n4 / 2021-12-amun-findings

0 stars 0 forks source link

Due to lack of input validation , self transfer can happen #244

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

JMukesh

Vulnerability details

Impact

ERC20Facet.transferFrom() lack the check for the "to" and "from" address , due to which both address can be same causing the self transfer

Proof of Concept

https://github.com/code-423n4/2021-12-amun/blob/98f6e2ff91f5fcebc0489f5871183566feaec307/contracts/basket/contracts/facets/ERC20/ERC20Facet.sol#L147

Tools Used

manual reveiw

Recommended Mitigation Steps

add checks for the input parameters

0xleastwood commented 2 years ago

No direct security concern, marking as non-critical.