Decent - Greed's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L302-L310 https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20-L22

Vulnerability details

Impact

By exploiting this vulnerability, an attacker is able to steal all the native ETH locked in the bridge. The assets belong to legitimate users, meaning a loss of user funds, insolvency for the protocol and profit for the attacker.

The issue leading to the vulnerability can be exploited in a different way with a different impact but the following scenario is the most impactful

Proof of concept

The DecentEthRouter.sol contract stores users native ETH belonging to users using the addLiquidityEth() function.

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L302-L310

The function redeemEth() can be used to withdraw WETH but only if the msg.sender owns the dcntEth token and has approve() the router to use it.

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L285-L291

function redeemEth(
    uint256 amount
) public onlyIfWeHaveEnoughReserves(amount) {
    dcntEth.transferFrom(msg.sender, address(this), amount);
    weth.withdraw(amount);
    payable(msg.sender).transfer(amount);
}

The mint() function of DcntEth.sol contract is protected by the onlyRouter modifier, giving the ability to mint tokens to DecentEthRouter only.

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L8-L11 https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L24-L26

modifier onlyRouter() {
    require(msg.sender == router);
    _;
}

// ...

function mint(address _to, uint256 _amount) public onlyRouter {
    _mint(_to, _amount);
}

In order to set the router address, the function setRouter() is used but as you can see, it has no access control meaning anyone can call it and become the router

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20-L22

function setRouter(address _router) public {
    router = _router;
}

An attacker can set himself as the router using the setRouter() function, mint() a huge amount of tokens for himself, approve() the legitimate DecentEthRouter to spend it and call redeemEth() to steal all the ETH (converted from WETH) from the router before calling setRouter() again to set the protocol to its initial state.

The scenario exposed makes use of the redeemEth() function but the issue impacts all the functions used to retrieve funds

Tools used

Manual review

Recommended mitigation steps

Add access control to the setRouter() function

Assessed type

ETH-Transfer