Decent - DarkTower's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20

Vulnerability details

Impact

An attacker can gain access to onlyRouter privileged functions by setting themselves (EOA) or their contract as the router address and proceeding to mint/burn DcntEth tokens at will.

Proof of Concept

The DcntEth contract mints Decent Eth, the supposed Decent's Protocol tokenized Eth. Ideally, functions that influence token supply/circulation are protected by modifiers that restricts access to trusted addresses or the protocol team for example, the owner address with an onlyOwner modifier. But, the setRouter(address _router) function which sets up one such privilege for a specified router address is exposed to anyone. It gives the router address the privilege to mint & burn DcntEth tokens at will. The function doesn't verify that the caller actually owns the DcntEth contract or has privileges to modify it. It just goes ahead and sets the router address.

When an attacker gains access to the onlyRouter privileged actions, what can they do with it? Well, while burn is interesting (because you can burn from anyone's account), mint is more interesting because it makes you richer faster and you can engineer such a scenario below for a better outcome:

1. Alice is an EOA with 0 WETH.
2. She sees the setRouter() function, figures if she sets herself, she gains privileges, then proceeds to call the function setting her address as the router
3. She mints 10k DcntEth
4. Alice has gotten richer than she was 15 seconds ago
5. And while it might be arguable that the DcntEth token will prolly not have much trading volume in a DEX if any, she can redeem them for WETH anyway by interacting with the DecentEthRouter contract
6. She calls redeemWeth(), and if the DecentEthRouter has some WETH i.e enough reserves, she slowly offloads her DcntEth for WETH
7. Essentially, this becomes like taking a legit flash loan without fees except it quickly crumbles the protocol.

This is the affected code block: DcntEth::setRouter :

@>    function setRouter(address _router) public {
        router = _router;
    }

As you can see, the function is missing an access control modifier.

Tools Used

Manual Review

Recommended Mitigation Steps

Make the setRouter() function have access control. For example, doing something like:

-    function setRouter(address _router) public {
+    function setRouter(address _router) public onlyOwner {
         router = _router;
    }

Assessed type

Access Control