Reality Cards contest - heiho1's results

The world's first 'outcome ownership' prediction market.

General Information

Platform: Code4rena

Start Date: 10/06/2021

Pot Size: $45,000 USDC

Total HM: 21

Participants: 12

Period: 7 days

Judge: LSDan

Total Solo HM: 13

Id: 13

League: ETH

Reality Cards

Findings Distribution

Researcher Performance

Rank: 8/12

Findings: 3

Award: $585.97

🌟 Selected for report: 2

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: maplesyrup

Also found by: heiho1

Labels

bug
duplicate
2 (Med Risk)

Awards

585.971 USDC - $585.97

External Links

Handle

heiho1

Vulnerability details

Impact

RCMarket overrides NativeMetaTransaction which declares payable executeMetaTransaction ---- This function accepts a functionSignature and calls the function from the userAddress ---- This appears to be a possible attack vector

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

https://github.com/code-423n4/2021-06-realitycards/blob/86a816abb058cc0ed9b6f5c4a8ad146f22b8034c/contracts/lib/NativeMetaTransaction.sol#L31

This function is payable but the the encoded function invocation is arbitrary. This could potentially lead to locked ether as there is no clear withdrawal semantics.

Tools Used

Slither

If there is no clear reason for the method to be payable then it should not be made payable. If there is a reason then a withdrawal mechanism should be supported, i.e.

https://docs.soliditylang.org/en/v0.5.3/solidity-by-example.html#safe-remote-purchase

#0 - Splidge

2021-06-15T08:57:41Z

Duplicate of #43

#1 - dmvt

2021-07-11T11:02:10Z

duplicate of #43

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter