Gravity Bridge contest - JMukesh's results

Handle

JMukesh

Vulnerability details

Impact

state variable that are not updated throughout the contract they should be declared as constant to save gas

Proof of Concept

https://github.com/althea-net/cosmos-gravity-bridge/blob/92d0e12cea813305e6472851beeb80bd2eaf858d/solidity/contracts/CosmosToken.sol#L5

Tools Used

manual review

Recommended Mitigation Steps

declare it as constant

Handle

JMukesh

Vulnerability details

Impact

due to lack of checking of v and s value in recover() it become prone to signature malleability

Proof of Concept

check out the tryRecover() of ECDSA.sol

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/aefcb3e8aa4ee8da8e2b7022ffe4dcb57fbb0fdf/contracts/utils/cryptography/ECDSA.sol#L147

Tools Used

manual reveiw

Recommended Mitigation Steps

add necessary check to make the signature unique