Orderers Can Unauthorized Transfer User's Share In Single Step

[code423n4]

Lines of code

https://github.com/code-423n4/2022-04-phuture/blob/594459d0865fb6603ba388b53f3f01648f5bb6fb/contracts/vToken.sol#L81

Vulnerability details

Impact

The transferFrom function of vToken.sol can be done without any user permissions or strict security checks, requires only the caller must has ORDERER_ROLE as the access control, exposing it to the centralize risk if an orderer is compromised or act maliciously.

Proof of Concept

1. Attacker call transferFrom(victim, attacker, user_share)
2. transferFrom forward the call to _transfer() which just also forward the call to NAV.transfer()

Tools Used

None

Recommended Mitigation Steps

• Consider inheriting from the ERC20 standard or implementing an allowance check to prohibit users from transferring funds without approval.
• Allow only multi-signature wallets to call the function to reduce the likelihood of an attack.

[jn-lp]

duplicates #55