Canto Application Specific Dollars and Bonding Curves for 1155s - wisdomn_'s results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/asD/src/asDFactory.sol#L29

Vulnerability details

Impact

The asdFactory uses tx.origin for turnstile.register(). This goes against solidity best practices and can lead to serious vulnerabilities. The vulnerability lies in the asdFactory's constructor which uses tx.origin for turnstile.register()

        if (block.chainid == 7700 || block.chainid == 7701) {
            // Register CSR on Canto main- and testnet
            Turnstile turnstile = Turnstile(0xEcf044C5B4b867CFda001101c617eCd347095B44);
            turnstile.register(tx.origin);
        }

Tools Used

Manual Review

Recommended Mitigation Steps

Avoid using tx.origin to prevent vulnerabilities and attacks.

Assessed type

Error