Canto Application Specific Dollars and Bonding Curves for 1155s - btk's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/main/asD/src/asDFactory.sol#L33-L39

Vulnerability details

Impact

asD's are created from the asDFactoryvia CREATE1, an attacker can frontrun create to deploy at the same address but with different config. If the deployed chain reorg, a different asD might also be deployed at the same address.

Proof of Concept

    function create(string memory _name, string memory _symbol) external returns (address) {
        asD createdToken = new asD(_name, _symbol, msg.sender, cNote, owner());
        isAsD[address(createdToken)] = true;
        emit CreatedToken(address(createdToken), _symbol, _name, msg.sender);
        return address(createdToken);
    }

A simple scenario to demonstrate the issue:

• Bob setup a bot to monitor the mempool when a new asD token is deployed
• Bob's bot saw a deployment by a user at 0x76jute98...., fire a tx to mint immediately
• Alice frontrun asD deployment by deploying a malicious asD at 0x76jute98....
• Bob's transaction ended up into Alice's malicious asD

Tools Used

Manual review

Recommended Mitigation Steps

Use CREATE2 and the asD config as salt.

Assessed type

Other