Munchables - grearlake's results

Lines of code

https://github.com/code-423n4/2024-05-munchables/blob/main/src/managers/LockManager.sol#L275-#L294

Vulnerability details

Vulnerability details

When locking contract, _lock() function will be called, and unlock time of _lockRecipient of _tokenContract token wil be extended:

function _lock(
    address _tokenContract,
    uint256 _quantity,
    address _tokenOwner,
    address _lockRecipient
) private {
  .   .   .   .   .
    LockedToken storage lockedToken = lockedTokens[_lockRecipient][_tokenContract];   // <--- get lockedToken data
  .   .   .   .   .
    uint32 _lockDuration = playerSettings[_lockRecipient].lockDuration;

    if (_lockDuration == 0) {
        _lockDuration = lockdrop.minLockDuration;    // <---- get lock duration
    }
  .   .   .   .   .
    lockedToken.remainder = remainder;
    lockedToken.quantity += _quantity;
    lockedToken.lastLockTime = uint32(block.timestamp);
    lockedToken.unlockTime = uint32(block.timestamp) + uint32(_lockDuration);  // <----- extend unlock time
  .   .   .   .   .
}

But anyone can call lockOnBehalf() to lock token for other lockRecipient:

function lockOnBehalf(
    address _tokenContract,
    uint256 _quantity,
    address _onBehalfOf
)
    external
    payable
    notPaused
    onlyActiveToken(_tokenContract)
    onlyConfiguredToken(_tokenContract)
    nonReentrant
{
    address tokenOwner = msg.sender;
    address lockRecipient = msg.sender;
    if (_onBehalfOf != address(0)) {
        lockRecipient = _onBehalfOf;     // <----
    }

    _lock(_tokenContract, _quantity, tokenOwner, lockRecipient);   // <---
}

It will lead to problem that anyone can DoS other user from unlock by calling lockOnBehalf for other user with dust amount

Impact

Other user are not able to withdraw because of this griefing attack.

Tools Used

Manual review

Recommended Mitigation Steps

Using signature to verify permission to lock token on behalf of other user.

Assessed type

Other