Skip to content

Latest commit

 

History

History
43 lines (25 loc) · 1.45 KB

093.md

File metadata and controls

43 lines (25 loc) · 1.45 KB

Cheesy Cinnabar Mammoth

Medium

updateDonationRecipient transfers donations from unrelated markets

Summary

ReputationMarket::updateDonationRecipient can inadvertently transfer all donations from multiple markets if the same recipient is used across them. This occurs because the donationEscrow mapping tracks balances by recipient address only, not by market.

Root Cause

Donations aren't accounted for by profileId: https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/main/ethos/packages/contracts/contracts/ReputationMarket.sol#L125-L127

Internal pre-conditions

  1. One address is the donation recipient for 2 or more markets
  2. Donations for 2 or more markets have been received by the one address
  3. The donation recipient calls updateDonationRecipient for one of the markets

External pre-conditions

n/a

Attack Path

  1. Let's say Alice is the donation recipient for Market A and Market B
  2. Both markets generate donations, so donationEscrow[alice] contains funds from both markets
  3. Alice calls updateDonationRecipient for Market A to transfer to Bob
  4. The function will transfer ALL of Alice's donation escrow to Bob, including the funds from Market B even though Alice is still the donation recipient for that market.

Impact

Loss of funds for the donation recipient.

PoC

No response

Mitigation

Donations should be tracked per market and recipient to ensure transfers only affect the intended market's funds.