Maia DAO - Ulysses - 0xDING99YA's results

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/VirtualAccount.sol#L84-L112

Vulnerability details

Impact

payableCall() in VirtualAccount.sol has no access control and anyone can steal the token from it

Proof of Concept

payableCall() in VirtualAccount.sol has no access control at all:

function payableCall(PayableCall[] calldata calls) public payable returns (bytes[] memory returnData) {
    uint256 valAccumulator;
    uint256 length = calls.length;
    returnData = new bytes[](length);
    PayableCall calldata _call;
    for (uint256 i = 0; i < length;) {
        _call = calls[i];
        uint256 val = _call.value;
        // Humanity will be a Type V Kardashev Civilization before this overflows - andreas
        // ~ 10^25 Wei in existence << ~ 10^76 size uint fits in a uint256
        unchecked {
            valAccumulator += val;
        }

        bool success;

        if (isContract(_call.target)) (success, returnData[i]) = _call.target.call{value: val}(_call.callData);

        if (!success) revert CallFailed();

        unchecked {
            ++i;
        }
    }

    // Finally, make sure the msg.value = SUM(call[0...i].value)
    if (msg.value != valAccumulator) revert CallFailed();
}

As a result anyone can call any token contract through it and transfer the token in this Virtual Account.

Tools Used

Manual Review

Recommended Mitigation Steps

Add requiresApprovedCaller modifier like call().

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchPort.sol#L330-L335

Vulnerability details

Impact

setCoreRouter() in BranchPort.sol requires only coreRouter can call it, however, there is no such function in CoreBranchRouter.sol to call this function. As a result this function is unreachable.

Proof of Concept

setCoreRouter() has a requireCoreRouter modifier, so only coreBranchRouter can call it. CoreBranchRouter.sol inherits from the BaseBranchRouter.sol, however, in both these two contracts there is no way to trigger a call to setCoreRouter() in BranchPort.sol. So setCoreRouter() is unaccessible.

Tools Used

Manual Review

Recommended Mitigation Steps

in executeNoSettlement() in CoreBranchRouter.sol add a case to call setCoreRouter()

Assessed type

Other