PoolTogether - YY's results

Lines of code

https://github.com/GenerationSoftware/pt-v5-prize-pool/blob/4bc8a12b857856828c018510b5500d722b79ca3a/src/PrizePool.sol#L299-L306

Vulnerability details

Impact

The setDrawManager function in the contract can be invoked by any Ethereum address. This exposes the contract to potential risks if malicious actors exploit this unrestricted access.

A malicious actor could potentially take control of the contract by setting the drawManager address to an address under their control before the legitimate owner gets a chance to set it.

function setDrawManager(address _drawManager) external {
    if (drawManager != address(0)) {
        revert DrawManagerAlreadySet();
    }
    drawManager = _drawManager;
    emit DrawManagerSet(_drawManager);
}

Proof of Concept

function setDrawManager set as external and there is only one restriction to prevent drawManager is not equal to 0, which means drawManager can be any address.

Alice sees that the smart contract has been deployed but the drawManager hasn't been set yet. She try to set the drawManager to an address under her control. The contract now follows Alice's commands instead of the intended drawManager address.

Tools Used

Manual Analysis

Recommended Mitigation Steps

Implement a permission scheme (e.g., an onlyOwner modifier) to limit who can call the setDrawManager function. Only the owner of the contract or an authorized address should have the right to execute this function.

Assessed type

Access Control