Lens Protocol V2 - tnquanghuy0512's results

Lines of code

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/FollowNFT.sol#L118-L123 https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/FollowNFT.sol#L131-L138 https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/FollowNFT.sol#L141-L153 https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/FollowNFT.sol#L311-L339

Vulnerability details

Impact

The users who got access to followNFT by got the approval by owner using approve() In the contract FollowNFT, authorizing the permision to execute some function got check by:

• If the executers own that NFT
• If the executers got setApprovalForAll() by the owner

This means, the executers who got approve() by the owner will not be able to execute some functions which are:

• LensHub.unfollow()
• LensHub.unfollowWithSig()
• LensHub.follow()
• LensHub.followWithSig()
• FollowNFT.removeFollower()
• FollowNFT.approveFollow()

Proof of Concept

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/FollowNFT.sol#L118-L123

    function unfollow(uint256 unfollowerProfileId, address transactionExecutor) external override onlyHub {
        ...
            if (
                (followTokenOwner != unfollowerProfileOwner) &&
                (followTokenOwner != transactionExecutor) &&
                !isApprovedForAll(followTokenOwner, transactionExecutor) &&
                !isApprovedForAll(followTokenOwner, unfollowerProfileOwner)
            ) {
                revert DoesNotHavePermissions();
            }
            ...
        }
    }

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/FollowNFT.sol#L131-L138

    function removeFollower(uint256 followTokenId) external override {
        ...
        if (followTokenOwner == msg.sender || isApprovedForAll(followTokenOwner, msg.sender)) {
            ...
        } else {
            revert DoesNotHavePermissions();
        }
    }

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/FollowNFT.sol#L141-L153

    function approveFollow(uint256 followerProfileId, uint256 followTokenId) external override {
        ...
        if (followTokenOwner != msg.sender && !isApprovedForAll(followTokenOwner, msg.sender)) {
            revert DoesNotHavePermissions();
        }
        ...
    }

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/FollowNFT.sol#L311-L339

    function _followWithWrappedToken(
        uint256 followerProfileId,
        address transactionExecutor,
        uint256 followTokenId,
        address followTokenOwner
    ) internal returns (uint256) {
        ...
        if (
            !isFollowApproved &&
            followTokenOwner != followerProfileOwner &&
            followTokenOwner != transactionExecutor &&
            !isApprovedForAll(followTokenOwner, transactionExecutor) &&
            !isApprovedForAll(followTokenOwner, followerProfileOwner)
        ) {
            revert DoesNotHavePermissions();
        }
        ...
    }

Tools Used

VSCode

Recommended Mitigation Steps

Add LensBaseERC721.getApproved() in the requirements or use LensBaseERC721._isApprovedOrOwner()

Assessed type

Invalid Validation