Closed sherlock-admin4 closed 4 months ago
Per the Q&A, only ETH is supported, so this issue is not exploitable at this time. However, I've taken the suggestion of adding permission checks to the collect*Fee
functions to eliminate the risk of being called by any unexpected parties.
threadmodeling
high
Funds from users can be drained through frontrunning
FeeManager.collectMintFee
with arbitrary inputsSummary
FeeManager.collectMintFee
can be called from anyone with any parameters, hence trigger the transfer of funds from any user, with any arbitrary amount of fee, while the attacker being the referrer and getting a shareVulnerability Detail
FeeManager.collectMintFee
isn't access controlled:Also, the parameters aren't validated.
getMintFee()
will look-up thestrategy
used and will multiply it by thequantity
down the line:We're then in a
_collectMintFee
scenario computation each one's share.The
payer
(victim) is assumed to haveapproved
the contract for transferring funds and will be thefrom
andfeePayer_
address here :While the
_feeReceivers
are computed from storage, this isn't the case for the user-inputaddress referrer_
:Let's remind here that the user won't gain anything: they'll just be paying fees, while having previously approved the contract for a future operation (be it a specific amount of approval or an infinite approval). If they try to call a mint function after that, they'll need to pay fees again. Given how we are usually offered to sign an
approve
transaction on Metamask before triggering an operation, this here can be easily frontrunnable, with the attacker earning a share by abusing all of the user's approved funds.Impact
Users' funds are drained while nothing is gained in return.
Calls to
collectMintFee()
, inEdition
's mint functions, are DOSd by either allowance consumed or funds drained from usersCode Snippet
Tool used
Manual Review
Recommendation
Several paths can be thought of:
collectMintFee
should be permissioned, like several other functions fromFeeManager
. Authorized addresses should be kept track of. The approval mechanism can be moved to transfer funds from Edition contracts