Fix (audit AUR-11): Infinite Amounts Can Be Transferred to One’s Self

[mrLSD]

Description

After Sigma Prime Aurora Engine and Eth-Connector audit, was detected potential issue: AUR-11 - Infinite Amounts Can Be Transferred to One’s.

Details

Balance checks are performed in the function internal_transfer_eth_on_near(). The following snippet of the function ft_transfer_call() show how the balance checks are skipped if sender_id == receiver_id.

if sender_id != receiver_id {
    self.internal_transfer_eth_on_near(&sender_id, &receiver_id, amount, memo)?;
}

The impact is not significant to the current contract as the net balances and total supply remain unchanged. However, this poses a potential threat to third party contracts. ft_transfer_call() makes the external call receiver_id.ft_on_transfer(amount, msg, sender_id). Since we are able to set amount as any arbitrary value this
may lead to issues in the accounting of third party contracts.

Solution

Added extra verification in ft_transfer_call, for the case sender_id == receiver_id:

• amount > 0
• balance_of_sender >= amount

Gas cost

Not changed

How to review

Pay attention to ft_transfer_call method

Tests

Extended to check the balance for sender_id, when sender_id == receiver_id in ft_transfer_call.

[joshuajbouw]

Looks like this settles that issue. Thanks.