[PoC] Exploit against AccountManager internalTransfer

[dna-thug]

This is my PoC for the bug I found in AccountManager contract.

The issue is in internalTransfer. The contract allows anyone to send tokens from any address, even if that address has no balance or is not owned by them.

I used address(1) as the fake sender and sent 1000 tokens to my own account without having any real balance there.

I added the PoC in test/c4-poc/PoC.t.sol file.

To test it, use:
forge test --match-test submissionValidity

[dna-thug]

Thanks for the opportunity. I found this issue while testing the internalTransfer logic.

This PoC shows how an attacker can move tokens from an address like address(1) which has no real balance. No ownership check is done on from, so it's exploitable.

Let me know if anything needs to be changed or improved.