Decent - azanux's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/3460106d1cd976e0235695676a9e318f750cd4dd/src/DcntEth.sol#L20

Vulnerability details

Impact

An attacker could change the router in this Token to another router, allowing them to mint tokens for themselves. Consequently, the DecentEthRouter would not be able to add liquidity, or users would be unable to withdraw their tokens.

Proof of Concept

Get the address of the Token DcntEth. Set the address of a new router. Mint new tokens for a user. Set the address of the old router. Withdraw the amount that was minted.

    function testRouter() public {

        assertEq(router, dcntEth.router());

        dcntEth.setRouter(router2);

        console2.log("router is", router);
        //check the router
        assertEq(router2, dcntEth.router());
    }

Tools Used

foundry

Recommended Mitigation Steps

Only an admin should be able to set the router for DcntEth, add onlyOwner modifier in front of the function setRouter

 function setRouter(address _router) public onlyOwner 

Assessed type

Access Control