Decent - 0xdice91's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L17-L22

Vulnerability details

Impact

In DcntEth.solthe setRouter() function can be called by anyone to change the router used by the protocol, an attacker can change the router contract to a malicious one controlled by him to mint(), burn() and also steal users funds whenever they interact with the router.

Proof of Concept

You can see setRouter() function here. Github Link Here

    /**
     * @param _router the decentEthRouter associated with this eth
     */
    function setRouter(address _router) public {
        router = _router;
    }

It can be called by anyone to change the router.

Tools Used

Manual Analysis

Recommended Mitigation Steps

add the onlyOwner modifier to the function.

    /**
     * @param _router the decentEthRouter associated with this eth
     */
-  function setRouter(address _router) public {
+  function setRouter(address _router) public onlyOwner {
        router = _router;
    }


## Assessed type

Access Control