It is possible to duplicate currently held ink or art within a Cauldron, thereby breaking the contracts accounting system and minting units out of thin air.
The stir function of the Cauldron, which can be invoked via a Ladle operation, caches balances in memory before decrementing and incrementing. As a result, if a transfer to self is performed, the assignment balances[to] = balancesTo will contain the added-to balance instead of the neutral balance.
This allows one to duplicate any number of ink or art units at will, thereby severely affecting the protocols integrity. A similar attack was exploited in the third bZx hack resulting in a roughly 8 million loss.
Recommend that a require check should be imposed prohibiting the from and to variables to be equivalent.
albertocuestacanada (Yield) confirmed:
