Munchables - bctester's results

Lines of code

https://github.com/code-423n4/2024-05-munchables/blob/57dff486c3cd905f21b330c2157fe23da2a4807d/src/managers/LockManager.sol#L275

Vulnerability details

Impact

An attacker can use the lockOnBehalf function to continuously extend the lock time of any player, resulting in the player's tokens being permanently locked. Additionally, since there is no minimum token amount restriction for calling the lockOnBehalf function, the attack cost is very low.

Proof of Concept

The code for the lockOnBehalf function is as follows:

    function lockOnBehalf(
        address _tokenContract,
        uint256 _quantity,
        address _onBehalfOf
    )
        external
        payable
        notPaused
        onlyActiveToken(_tokenContract)
        onlyConfiguredToken(_tokenContract)
        nonReentrant
    {
        address tokenOwner = msg.sender;
        address lockRecipient = msg.sender;
        if (_onBehalfOf != address(0)) {
            lockRecipient = _onBehalfOf;
        }

        _lock(_tokenContract, _quantity, tokenOwner, lockRecipient);
    }

The code for extending the lock time in the _lock function is as follows:

    function _lock(
        address _tokenContract,
        uint256 _quantity,
        address _tokenOwner,
        address _lockRecipient
    ) private {
...
        lockedToken.unlockTime =
            uint32(block.timestamp) +
            uint32(_lockDuration);
}

The code for checking the unlockTime when unlocking is as follows:

    function unlock(
        address _tokenContract,
        uint256 _quantity
    ) external notPaused nonReentrant {
        ...
        if (lockedToken.unlockTime > uint32(block.timestamp))
            revert TokenStillLockedError();
        ...
}

By analyzing the above code, it can be seen that an attacker can extend the lock time of any player.

Tools Used

Recommended Mitigation Steps

Add restrictions when extending the lock time for other players, such as only allowing addresses authorized by the player to extend the lock time, or limiting the minimum token amount.

Assessed type

Other