search

semaphore-protocol / semaphore

A zero-knowledge protocol for anonymous interactions.
https://semaphore.pse.dev
MIT License
887 stars 194 forks source link

missing admin access check #689

Closed 0xDatapunk closed 6 months ago

0xDatapunk commented 6 months ago

the _addMember function is missing onlyGroupAdmin(groupId) check, Without it anyone can add to the group.

https://github.com/semaphore-protocol/semaphore/blob/8eb19e83fda62644872b2fcfbd85011d3b2c21e2/packages/contracts/contracts/base/SemaphoreGroups.sol#L83

cedoor commented 6 months ago

Assigned to @zkfriendly