Maia DAO - Ulysses - DanielArmstrong's results

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/main/src/ArbitrumCoreBranchRouter.sol#L168

Vulnerability details

Impact

The router in Arbitrum branch is not upgradable at all, even when the router has serious problem or has necessity of upgrade.

Proof of Concept

The executeNoSettlement function of CoreBranchRouter can change coreBranchRouterAddress of BranchPort. But the overrided executeNoSettlement function of ArbitrumCoreBranchRouter cannot change coreBranchRouterAddress of BranchPort. As a result, there is no way to change router in Arbitrum branch.

CoreBranchRouter.sol#140-146 call setCoreBranchRouter function of BranchPort and change coreBranchRouterAddress of it in the case of _params[0] == 0x07.

        } else if (_params[0] == 0x07) {
            (address coreBranchRouter, address coreBranchBridgeAgent) = abi.decode(_params[1:], (address, address));

            IPort(localPortAddress).setCoreBranchRouter(coreBranchRouter, coreBranchBridgeAgent);

            /// Unrecognized Function Selector
        } else {

On the other hand, ArbitrumCoreBranchRouter.sol#162-170 does not process the case of _params[0] == 0x07 and revert.

        } else if (_data[0] == 0x06) {
            (address portStrategy, address underlyingToken, uint256 dailyManagementLimit, bool isUpdateDailyLimit) =
                abi.decode(_data[1:], (address, address, uint256, bool));
            _managePortStrategy(portStrategy, underlyingToken, dailyManagementLimit, isUpdateDailyLimit);

            /// Unrecognized Function Selector
        } else {
            revert UnrecognizedFunctionId();
        }

As a result, there is no way to change router in Arbitrum branch.

Tools Used

Mannual Review

Recommended Mitigation Steps

Insert code into ArbitrumCoreBranchRouter.sol#162 as follows.

        } else if (_data[0] == 0x06) {
            (address portStrategy, address underlyingToken, uint256 dailyManagementLimit, bool isUpdateDailyLimit) =
                abi.decode(_data[1:], (address, address, uint256, bool));
            _managePortStrategy(portStrategy, underlyingToken, dailyManagementLimit, isUpdateDailyLimit);

            /// _setCoreBranchRouter
        } else if (_params[0] == 0x07) {
            (address coreBranchRouter, address coreBranchBridgeAgent) = abi.decode(_params[1:], (address, address));

            IPort(localPortAddress).setCoreBranchRouter(coreBranchRouter, coreBranchBridgeAgent);

            /// Unrecognized Function Selector
        } else {
            revert UnrecognizedFunctionId();
        }

Assessed type

Error