Decent - al88nsk's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20

Vulnerability details

Impact

Function setRouter in contract DcntEth has no access control and anyone can set router for the contract. After that the attacker can mint and burn any amount of DcntEth tokens for any address, because mint and burn functions are protected by onlyRouter modifier.

Proof of Concept

One of the possible attack scenarios:

1. The attacker sets router that he controls
2. The attacker mints DcntEth tokens for himself
3. The attacker uses redeemWeth function from DecentEthRouter contract that transfers DcntEth tokens to the contract and then transfers WETH to the attacker (or the attacker can call redeemEth)

This way the attacker can withdraw all WETH from DecentEthRouter.

Tools Used

Manual review

Recommended Mitigation Steps

Add modifier onlyOwner to setRouter function.

Assessed type

Access Control