Livepeer contest - 0x1f8b's results

Handle

0x1f8b

Vulnerability details

Impact

It's possible to deny burn to the admin.

Proof of Concept

The method burn in LivepeerToken it's vulnerable to front-running attack, if a user detect that the owner want to burn his tokens, he can always transfer the tokens to another account, and make burn fail. This contract should implement Pausable logic.

Tools Used

Manual review.

Recommended Mitigation Steps

Inherit Pausable in LivepeerToken .

Handle

0x1f8b

Vulnerability details

Impact

Possible frozen gateway.

Proof of Concept

Even though this logic is intentional, it is necessary to mention that the ControlledGateway contract allows to pause its functionality and consequently revoke or give up the administrator role and the pausable role, which would finally leave the contract permanently and irrevocably useless.

Tools Used

Manual review.

Recommended Mitigation Steps

Prevent revoke role if the contract is paused.

Handle

0x1f8b

Vulnerability details

Impact

Gas saving.

Proof of Concept

Remove DelegatorPool.transferBond and use inline implementation, this method only call another method, and it's used only once, is not required.

Tools Used

Manual review.

Recommended Mitigation Steps

Remove DelegatorPool.transferBond and use inline implementation.

Handle

0x1f8b

Vulnerability details

Impact

Gas saving.

Proof of Concept

There are some methods where the increment was made by i++, it's better to use ++i.

• L1Migrator.getMigrateUnbondingLocksParams
• L2Migrator.finalizeMigrateUnbondingLocks

Tools Used

Gas saving

Recommended Mitigation Steps

Use ++i

Handle

0x1f8b

Vulnerability details

Impact

requireValidMigration bypass.

Proof of Concept

The logic of the method requireValidMigration inside the contract L1Migrator could be bypassed.

The code doesn't check that the _l1Addr it's different than address(0).

require(
            msg.sender == _l1Addr ||
                recoverSigner(_structHash, _sig) == _l1Addr,
            "L1Migrator#requireValidMigration: FAIL_AUTH"
        );

And the code recoverSigner has a condition to return address(0) if the signature is empty.

if (_sig.length == 0) {
            return address(0);
        }

So if the user send an empty signature (_sig='') and _l1Addr=address(0) during the call of requireValidMigration it will bypass the logic and bypass the signature verification. This can produce important errors in all the methods that delegate this verification to this method.

Afected methods:

• migrateDelegator
• migrateUnbondingLocks
• migrateSender

Tools Used

Manual review.

Recommended Mitigation Steps

Check that _l1Addr is not address(0) inside requireValidMigration.