Decent - 0xdedo93's results

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L311 https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L134 https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L228

Vulnerability details

Impact

There exist a codepath that allows any users to call the function swapAndExecute (which is a wrapper to function _swapAndExecute) without paying Decent protocol fees. To exploit the bug it is as simple as calling directly the public function receiveFromBridge which in turns reach the function _swapAndExecute without passing through the check of the modifier retrieveAndCollectFees .

By calling the functionreceiveFromBridge it is possible to achieve a swap and execute operation without paying for the fees, as you can control all the arguments passed in to the function _swapAndExecute.

Proof of Concept

The function swapAndExecute is the legit entrypoint for a swap and execute operation

function swapAndExecute https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L108

function _swapAndExecute https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L134

modifier retrieveAndCollectFees https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L228

function receiveFromBridge https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L311

As shown in Decent protocol test function testSwapWethToUsdcAndMintAnNft (file name UTBExactOutRoutesTestEth2Eth.t.sol) the UTB function swapAndExecute is called as follows:

utb.swapAndExecute(instructions, fees, signature);

The same logic operation can be achieved by the following code:

SwapInstructions memory swapInstructions =
SwapInstructions({swapperId: swapper.getId(), swapPayload: abi.encode(swapParams, address(utb), refund)});

utb.receiveFromBridge(swapInstructions, address(cat), address(cat), abi.encodeCall(cat.mintWithUsdc, (bob)), refund);

which calls the public function with no modifier check.

Tools Used

Foundry

Recommended Mitigation Steps

Add the modifier retrieveAndCollectFees for the function receiveFromBridge

Assessed type

Other