Decent - Nikki's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20

Vulnerability details

Impact

The function DcntEth.setRouter has no access control which is resposible for setting the router address. Also this router address has the authority to mint and burn tokens. Lack of access control leads anyone to set their address as router and mint unlimited tokens. User can then burn those tokens to convert them into ETH. This will lead to loss of funds for the protocol.

Proof of Concept

1. Attacker sets his own address as router.
2. Calls mint function to mint some tokens
3. Attacker sets back the previous router address.
4. Finally attacker converts DcntEth tokens to Eth by calling DecentEthRouter.removeLiquidityEth().

Tools Used

Manual Review

Recommended Mitigation Steps

Enforce access control by allowing only owner to set the value.

    /**
     * @param _router the decentEthRouter associated with this eth
     */
-    function setRouter(address _router) public {
+    function setRouter(address _router) public onlyOwner {
         router = _router;
     }

Assessed type

Access Control