Axelar Network - 0xkazim's results

Lines of code

https://github.com/code-423n4/2023-07-axelar/blob/2f9b234bb8222d5fbe934beafede56bfb4522641/contracts/cgp/governance/InterchainGovernance.sol#L87-L103 https://github.com/axelarnetwork/axelar-gmp-sdk-solidity/blob/b062627673a86d4497d59fdaddf54c07578e3bf9/contracts/executable/AxelarExecutable.sol#L17-L29

Vulnerability details

Impact

the function _execute need to set to payable because it handle/work with the native tokens and it should be set to payable. this function is internal and is called in the execute function in the AxelarExecutable.sol which is not payable too.

note // the AxelarExecutable.sol is out of scope but we talk about the _executefunction which is in the scope

Proof of Concept

the _execute function using native token when it call the process command to create a proposal

function _execute(
    string calldata sourceChain,
    string calldata sourceAddress,
    bytes calldata payload
) internal override {
    //@audit add payable
    if (keccak256(bytes(sourceChain)) != governanceChainHash || keccak256(bytes(sourceAddress)) != governanceAddressHash)
        revert NotGovernance();

    (uint256 command, address target, bytes memory callData, uint256 nativeValue, uint256 eta) = abi.decode(
        payload,
        (uint256, address, bytes, uint256, uint256)
    );

    if (target == address(0)) revert InvalidTarget();

    _processCommand(command, target, callData, nativeValue, eta);
}

the execute function which calling the function above is not payable too(out of the scope)

function execute(
    bytes32 commandId,
    string calldata sourceChain,
    string calldata sourceAddress,
    bytes calldata payload
) external {
    bytes32 payloadHash = keccak256(payload);

    if (!gateway.validateContractCall(commandId, sourceChain, sourceAddress, payloadHash)) revert NotApprovedByGateway();

    _execute(sourceChain, sourceAddress, payload);
}

the payable should be set to _execute function if it use native tokens.

Tools Used

manual review

Recommended Mitigation Steps

add payable to the function _execute

Assessed type

Payable