The transfer_public_as_signer function can be used by a malicious program/contract to steal users credits
Summary
Due to the weak sender requirement in the transfer_public_as_signer function, a malicious program can be created to steal users' credits without their awareness.
Vulnerability Detail
The transfer_public_as_signer function uses self.signer as the sender of credits, so it means that a intermediate program can call the function while the sender of the credits will be the user calling the intermediate program. This can be exploited by a malicious actor that makes a program seems legit but when a user interacts with it, it calls transfer_public_as_signer with setting the receiver to the malicious actor and the amount to the user's public credits, resulting in the user's credits being transferred(stolen) without their knowledge. This issue arises because users do not need to explicitly authorize these transfers, making the function convenient but problematic.
Impact
Loss of funds for users who interact with a malicious program.
Delete the function since there is already a transfer_public function that uses the caller as the sender or introduce a mechanism similar to ERC-20's approve and transferFrom to ensure that users explicitly authorize transfers.
morbsel
High
The
transfer_public_as_signerfunction can be used by a malicious program/contract to steal users creditsSummary
Due to the weak sender requirement in the
transfer_public_as_signerfunction, a malicious program can be created to steal users' credits without their awareness.Vulnerability Detail
The
transfer_public_as_signerfunction usesself.signeras the sender of credits, so it means that a intermediate program can call the function while the sender of the credits will be the user calling the intermediate program. This can be exploited by a malicious actor that makes a program seems legit but when a user interacts with it, it callstransfer_public_as_signerwith setting the receiver to the malicious actor and the amount to the user's public credits, resulting in the user's credits being transferred(stolen) without their knowledge. This issue arises because users do not need to explicitly authorize these transfers, making the function convenient but problematic.Impact
Loss of funds for users who interact with a malicious program.
Code Snippet
https://github.com/sherlock-audit/2024-05-aleo/blob/55b2e4a02f27602a54c11f964f6f610fee6f4ab8/snarkVM/synthesizer/program/src/resources/credits.aleo#L804
Tool used
Manual Review
Recommendation
Delete the function since there is already a
transfer_publicfunction that uses the caller as the sender or introduce a mechanism similar to ERC-20'sapproveandtransferFromto ensure that users explicitly authorize transfers.Duplicate of #15