Submitted by pfapostol, also found by 0xlemon and yixxas
Switching to DAO phase in NukeFund is not possible. This vulnerability is on the boundary of scope because it makes it impossible to use the out-of-scope contract but the problem is in the contact inside the scope that is the owner of this external contract.
The TraitForgeNft contract is written in such a way that it can add and remove users from the airdrop. For this the NFT contract must have ownership over the airdrop contract.
Because of this, an additional function is created in TraitForgeNft to start the airdrop while other functions that can only be called by the owner (setTraitToken, allowDaoFund) are absent in TraitForgeNft contract. Which makes these functions impossible to call.
The first function may not be necessary (deployer can call it at deploy), but the second function must have its own handle in the TraitForgeNft contract since this function is used by NukeFund and can only be called after the start of the airdrop; that is, after the transfer of ownership to the TraitForgeNft contract.
With normal initialization owner of Airdrop is TraitForgeNft:
There is no way to call Airdrop.allowDaoFund(). The third stage in NukeFund dev share distribution relies completely on airdropContract.daoFundAllowed().
Add delegate handle to TraitForgeNft:
Access Control
pfapostol (warden) commented:
samuraii77 (warden) commented:
Koolex (judge) commented:
Note: For full discussion, see here.
