Maia DAO - Ulysses - 7ashraf's results

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/main/src/BranchPort.sol#L355 https://github.com/code-423n4/2023-09-maia/blob/main/src/BranchPort.sol#L375 https://github.com/code-423n4/2023-09-maia/blob/main/src/BranchPort.sol#L396 https://github.com/code-423n4/2023-09-maia/blob/main/src/RootPort.sol#L369 https://github.com/code-423n4/2023-09-maia/blob/main/src/RootPort.sol#L414 https://github.com/code-423n4/2023-09-maia/blob/main/src/RootPort.sol#L431

Vulnerability details

Toggle function overwrites the create function with potential DOS risks

Instances

BranchPort.sol #348 https://github.com/code-423n4/2023-09-maia/blob/main/src/BranchPort.sol#L348

 function toggleBridgeAgentFactory(address _newBridgeAgentFactory) external override requiresCoreRouter {
        isBridgeAgentFactory[_newBridgeAgentFactory] = !isBridgeAgentFactory[_newBridgeAgentFactory];

        emit BridgeAgentFactoryToggled(_newBridgeAgentFactory);
    }

BranchPort.sol#355 https://github.com/code-423n4/2023-09-maia/blob/main/src/BranchPort.sol#L355

BranchPort.sol#375 https://github.com/code-423n4/2023-09-maia/blob/main/src/BranchPort.sol#L375

BranchPort.sol#396 https://github.com/code-423n4/2023-09-maia/blob/main/src/BranchPort.sol#L396

https://github.com/code-423n4/2023-09-maia/blob/main/src/RootPort.sol#L369

https://github.com/code-423n4/2023-09-maia/blob/main/src/RootPort.sol#L414

https://github.com/code-423n4/2023-09-maia/blob/main/src/RootPort.sol#L431

Description

The toggle function checks inverts the value foo inside of isFoo[] array, which is part of adding creating a foo through the creation method.

Proof of concept

The function toggleBridgeAgentFactory reverts the isBridgeAgentFactory[_newBridgeAgentFactory] value, in case bridge agent factory of address 0x123 did not exist before will now has isBridgeAgentFactory[address] equal to true.

which is the same as creating a new branch bridge agent factory, the only difference that the logic will be missing the bridgeAgentFactories.push(_newBridgeAgentFactory); and the event will not be emmitted.

Impact

• breaking the logic of the creation function
• potential locked, DOS branch bridge agent factories
• potential locked funds due to strategy tokens not existing the in the strategyTokens array

Mitigation

• Need to check if foo exists first before toggling its state, if exists already, then proceed to toggle, if not exists, either revert or add new foo then togggle the state.
• emit an event on toggle functions,

Assessed type

DoS