search

code-423n4 / 2022-09-party-findings

2 stars 0 forks source link

Anybody can claim fee by parsing arbitrary DistributionInfo in function argument #299

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/PartyDAO/party-contracts-c4/blob/main/contracts/distribution/TokenDistributor.sol#L190-L222

Vulnerability details

Impact

TokenDistributor.claimFee() is a public function that accepts user-controlled input. The function logic would allow the transfer of funds from the contract to a receiver based on the arbitrary input from a user. With this, anybody can claim fee by parsing arbitrary DistributionInfo input in the function argument

Proof of Concept

https://github.com/PartyDAO/party-contracts-c4/blob/main/contracts/distribution/TokenDistributor.sol#L190-L222

  1. TokenDistributor contract has balance of 200 eth.
  2. Alice calls TokenDistributor.claimFee() with her address as recipient and a custom DistributionInfo such that; info.tokenType = TokenType.Native info.token = NATIVE_TOKEN_ADDRESS info.feeRecipient = alice info.fee = 199.99 eth
  3. Alice would receive 199.99 eth as the input would pass and the _transfer() called made to send eth to Alice as the receiver.

Tools Used

Manual review

Recommended Mitigation Steps

Apply necessary access controls

code423n4 commented 1 year ago

Withdrawn by cryptphi