fix: close sponsored claim+burn bond extraction vulnerability#107
Merged
fix: close sponsored claim+burn bond extraction vulnerability#107
Conversation
Track who paid the ownership bond via uuidOwnershipBondPayer mapping. For self-funded claims the payer is msg.sender; for sponsored claims it is the treasury. On burn the bond refunds to the recorded payer, closing a vulnerability where a whitelisted user could claim+burn sponsored UUIDs to extract treasury funds to their own wallet. Backward compatible: pre-upgrade tokens (bondPayer==address(0)) fall back to uuidOwner. On token transfer, bondPayer follows only if the previous owner was the payer (self-funded); sponsored bonds stay with the treasury. Storage: adds 1 mapping before __gap (reduced from 50 to 49 slots).
Defense-in-depth for the sponsored claim exploit: each whitelisted user now has a token-denominated allowance that is decremented on every consumeSponsoredBond call. When the allowance hits zero the user cannot consume any more sponsored bonds regardless of the global periodic quota. Amount-based (not claim-count-based) so the cap stays correct even if baseBond parameters change. Non-periodic: whitelist admin can top up via increaseUserBondAllowance or overwrite via setUserBondAllowance. New storage: mapping(address => uint256) public userBondAllowance New functions (WHITELIST_ADMIN_ROLE): setUserBondAllowance(address user, uint256 allowance) increaseUserBondAllowance(address user, uint256 amount) New error: UserBondAllowanceExceeded New events: UserBondAllowanceSet, UserBondAllowanceIncreased
LCOV of commit
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A whitelisted user could exploit
claimUuidSponsored+burnto extract bond tokens from the treasury to their personal wallet:claimUuidSponsored(uuid, operator, treasury)— treasury pays the bondburn(tokenId)— bond refunds touuidOwner(the user), not the treasurybytes16values)The only throttle was the periodic
QuotaControl, meaning the entire treasury was drainable over time.Solution
Two complementary fixes (defense-in-depth):
1. FleetIdentityUpgradeable: refund bond to original payer (root cause fix)
uuidOwnershipBondPayertracks who paid the ownership bondclaimUuid: payer =msg.sender(self-funded)claimUuidSponsored: payer =treasury_register(first registration): payer =msg.senderburn(owned-only): refunds touuidOwnershipBondPayerwith fallback touuidOwnerfor pre-upgrade tokensStorage: +1 mapping before
__gap(reduced from 50 to 49 slots). No reinitializer needed —address(0)falls back touuidOwner.2. BondTreasuryPaymaster: per-user NODL allowance (defense-in-depth)
userBondAllowance— token-denominated lifetime cap per userconsumeSponsoredBondchecks and decrements allowance before processingsetUserBondAllowance/increaseUserBondAllowance— managed byWHITELIST_ADMIN_ROLEbaseBondchangesTest Coverage
787 tests pass across 26 suites (0 failures).