Name: Trustline flag set on NFTokenMint TX's Can Max a Minters Reserve and Create Infinite Issued Currencies with No Reserve
About:
NFTs Utilizing Flag 12/13 on NFTokenMint Tx's with a Transfer Fee >0 are susceptible to spam trust lines and an increase in their reserve requirement while also allowing a currency issuer to create infinite currencies for no cost or reserve requirement.
labels:
NFTokenMint, Trustline Spam, neglibile reserve requirement
Issue Description
NFTs minted with the trustline & transferable flag enabled with a TransferFee > 0 are susceptible to attack by a malicious user which allows the attacker to create an infinite number of currencies on their attacking issuing account and maxes out the victims reserve requirement on the NFT account. At conception, this attack was very expensive to execute as an attacker but after optimization in the attacking method, it became a negligible cost and allowed the Currency issuer to issue assets without affecting their reserve requirement.
Steps to Reproduce
To reproduce, there are 4 accounts involved in the attack:
Victim Account: Issues an NFT, that is transferable, auto-creates the trustline and has a transfer fee > 0
Attacking Account A: Will be setting trustlines, creating and accepting NFT offers and sending back token to issuer.
Attacking Account B: Same as Account A
Attacking Currency Issuer (Account C): Issues Currencies to Account A and Account B
Attack sequence:
- Account A acquires a vulnerable NFT
- Account B creates a trustline to Account C for random currency 'xyz'
- Account C sends 1 'xyz' to Account B
- Account A creates a sell offer for NFT with destination set to Account B for 1 'xyz'
- Account B Accepts the sell offer from Account A (Account A Gets (1 'xyz'- (transferFee*1 'xyz')) and Victim gets (transferFee * 1 'xyz'))
- Account B removes the trustline for 'xyz'
- Account A Sends the received amount back to the issuer (this results in clearing reserve requirement for Account C)
- Repeat the process starting at step 2 with reversing the roles of Account A and Account B
Expected Result
The Attacker would be able to clog up the reserve requirement of the NFT issuer coming with a high cost to the attacker.
Actual Result
With the reserve requirement also becoming negligible, it allowed Account C to issue an infinite amount of currencies and max out the vulnerable NFT Minters reserve with a negligible cost to the attacker (only transaction fees).
Environment
Tested on rippled 1.9.2
Supporting
https://xls20.bithomp.com/explorer/r9LFTf81MW7ig1gXHcbaBKPh117szuf3XE
Name: Trustline flag set on NFTokenMint TX's Can Max a Minters Reserve and Create Infinite Issued Currencies with No Reserve
About:
NFTs Utilizing Flag 12/13 on NFTokenMint Tx's with a Transfer Fee >0 are susceptible to spam trust lines and an increase in their reserve requirement while also allowing a currency issuer to create infinite currencies for no cost or reserve requirement.
labels:
NFTokenMint, Trustline Spam, neglibile reserve requirement
Issue Description
NFTs minted with the trustline & transferable flag enabled with a TransferFee > 0 are susceptible to attack by a malicious user which allows the attacker to create an infinite number of currencies on their attacking issuing account and maxes out the victims reserve requirement on the NFT account. At conception, this attack was very expensive to execute as an attacker but after optimization in the attacking method, it became a negligible cost and allowed the Currency issuer to issue assets without affecting their reserve requirement.
Steps to Reproduce
To reproduce, there are 4 accounts involved in the attack:
Victim Account: Issues an NFT, that is transferable, auto-creates the trustline and has a transfer fee > 0
Attacking Account A: Will be setting trustlines, creating and accepting NFT offers and sending back token to issuer.
Attacking Account B: Same as Account A
Attacking Currency Issuer (Account C): Issues Currencies to Account A and Account B
Attack sequence:
Expected Result
The Attacker would be able to clog up the reserve requirement of the NFT issuer coming with a high cost to the attacker.
Actual Result
With the reserve requirement also becoming negligible, it allowed Account C to issue an infinite amount of currencies and max out the vulnerable NFT Minters reserve with a negligible cost to the attacker (only transaction fees).
Environment
Tested on rippled 1.9.2
Supporting
https://xls20.bithomp.com/explorer/r9LFTf81MW7ig1gXHcbaBKPh117szuf3XE