Decent - 0xabhay's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20-L22

Vulnerability details

Impact

The lack of access control on the DcntEth.sol::setRouter function allows any external actor to gain control over critical functionalities of the DcntEth contract. If exploited, an attacker could arbitrarily mint new tokens or burn existing tokens, leading to potential token inflation, deflation, or manipulation of user balances.

Proof of Concept

An attacker deploys their own malicious contract or uses an EOA (Externally Owned Account). The attacker calls the setRouter function of the DcntEth contract with the address of their malicious contract or EOA.

    function setRouter(address _router) public {
        router = _router;
    }

Once the router is set to the attacker's address, they can now call the mint function to mint an arbitrary number of tokens to any address, including their own. The attacker can also call the burn function to destroy tokens from any address without the consent of the token holders.

Tools Used

Manual Review

Recommended Mitigation Steps

Update the setRouter function to include an access control modifier such as onlyOwner. This ensures that only the contract owner can change the router address.

function setRouter(address _router) public onlyOwner {
    router = _router;
}

Assessed type

Access Control