Maia DAO - Ulysses - OMEN's results

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L587-L701 https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L785-L795 https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L730-L753 https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L712-L721

Vulnerability details

Impact

PerformFallBack is gonna fail and msg.value will be accumulated in that BranchBridgeAgent and malicious user can take over them

Proof of Concept

User deposited and When it's not executed ,user want to retrieve and callRetrieveSettlement ,send message to BranchBridgeAgent to retrieveSettlement

            //DEPOSIT FLAG: 3 (Retrieve Settlement)
    } else if (flag == 0x03) {
        // Parse recipient
        address payable recipient = payable(address(uint160(bytes20(_payload[PARAMS_START:PARAMS_START_SIGNED]))));


        //Get nonce
        nonce = uint32(bytes4(_payload[PARAMS_START_SIGNED:PARAMS_TKN_START_SIGNED]));


        //Check if settlement is in retrieve mode
        if (executionState[nonce] == STATUS_DONE) {
            revert AlreadyExecutedTransaction();
        } else {
            //Set settlement to retrieve mode, if not already set.
            if (executionState[nonce] == STATUS_READY) executionState[nonce] = STATUS_RETRIEVE;
            //Trigger fallback/Retry failed fallback
            _performFallbackCall(recipient, nonce);
        }

_performFallback is executed ,

       function _performFallbackCall(address payable _refundee, uint32 _settlementNonce) internal virtual {
    //Sends message to LayerZero messaging layer
    ILayerZeroEndpoint(lzEndpointAddress).send{value: address(this).balance}(
        rootChainId,
        rootBridgeAgentPath,
        abi.encodePacked(bytes1(0x09), _settlementNonce),
        _refundee,
        address(0),
        ""
    );
}

In _performFallback , ILayerZeroEndpoint.send is likely to revert cause there is lack of payable in _refundee or other reason,If they revert ,msg.value that send from RootBridgeAgent will be acummulated in branchBridgeAgent .Malicious user can drain easily them by calling one of execute function like singleSettlement . balance of that BranchBridgeAgent will be sent to Malicious user .

     function _execute(uint256 _settlementNonce, bytes memory _calldata) private {
    //Update tx state as executed
    executionState[_settlementNonce] = STATUS_DONE;


    //Try to execute the remote request
    (bool success,) = bridgeAgentExecutorAddress.call{value: address(this).balance}(_calldata);


    //  No fallback is requested revert allowing for settlement retry.
    if (!success) revert ExecutionFailure();
}

user can get gas more than deposited if _performFallBack is failed to execute.

Tools Used

manual view

Recommended Mitigation Steps

add payable to _refundee if _performFallback is failed to execute send those gas to somewhere safe.

Assessed type

Payable