Decent - Tigerfrake's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/main/src%2FDcntEth.sol#L20-L22 https://github.com/decentxyz/decent-bridge/blob/main/src%2FDcntEth.sol#L24-L26 https://github.com/decentxyz/decent-bridge/blob/main/src%2FDcntEth.sol#L28-L30

Vulnerability details

Impact

The DcntEth contract extends the OFTV2 contract and overrides its minting and burning functions to include additional checks. The contract also includes a setRouter() function to set the router address, which is required to call the mint() and burn() functions.

The router property is a public address variable. This address is used to control who can mint and burn tokens. The onlyRouter modifier is used to restrict certain functions (mint and burn) to be called only by the router address.

The setRouter() function allows the router address to be updated. The mint() and burn() functions are used to increase and decrease the supply of tokens. These functions can only be called by the router address due to the onlyRouter modifier.

However, the DcntEth contract lacks sufficient access control, which can lead to several potential attack vectors.

Proof of Concept

Here are some detailed explanations:

1. Unrestricted setRouter Function:

The setRouter() function allows any address to update the router address.

https://github.com/decentxyz/decent-bridge/blob/main/src%2FDcntEth.sol#L20

    function setRouter(address _router) public {

An attacker could call this function and set the router to their own address. Once they have done this, they can mint and burn tokens freely, manipulating the token supply. They could also burn tokens from other holders, causing them to lose value.

2. Centralization of Power:

The router address has significant power in the contract because it can mint and burn tokens.

https://github.com/decentxyz/decent-bridge/blob/main/src%2FDcntEth.sol#L24-L26

    function mint(address _to, uint256 _amount) public onlyRouter {

https://github.com/decentxyz/decent-bridge/blob/main/src%2FDcntEth.sol#L28-L30

    function burn(address _from, uint256 _amount) public onlyRouter {

If this address is compromised, an attacker could gain control over the token supply.

3. Lack of Checks in setRouter Function:

The setRouter() function doesn't check whether the new router is valid.

    function setRouter(address _router) public {
        router = _router;
    }

This could lead to unexpected behavior if the new router is not capable of handling the minting and burning operations.

Tools Used

Manual Review VS code

Recommended Mitigation Steps

To secure this contract against these attacks, you should implement additional access controls, decentralize the decision-making process, add checks in the setRouter() function

Assessed type

Access Control