Decent - Timenov's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20-L22

Vulnerability details

Impact

There is no access modifier in DcntEth::setRouter. Therefore anyone can call this function and change the router. This will bypass the modifier onlyRouter when mint() and burn() are called.

Proof of Concept

In this PoC, I will show how the attack can happen:

1. Create folder audit in the test folder.

2. Create file called DcntEthTest.t.sol.

3. Copy from this Gist and paste into the file.

4. Run forge test --match-test test_change_router in the terminal.

5. Test passes:

[PASS] test_change_router() (gas: 40988)

Tools Used

Manual Review, Foundry

Recommended Mitigation Steps

Add onlyOwner modifier to setRouter function:

-    function setRouter(address _router) public {
+    function setRouter(address _router) public onlyOwner {
         router = _router;
     }

Assessed type

Access Control