Taiko - blockdev's results

Lines of code

https://github.com/code-423n4/2024-03-taiko/blob/main/packages/protocol/contracts/L1/libs/LibProposing.sol#L307-L316

Vulnerability details

Impact

First block after genesis will never be proposed if the same address doesn't have both proposer_one and proposer role. If proposer_one is unset (address(0)), then this block can be proposed only if proposer role is also unset, or if proposer address proposes the block which is not the purpose of this role.

Proof of Concept

https://github.com/code-423n4/2024-03-taiko/blob/main/packages/protocol/contracts/L1/libs/LibProposing.sol#L307-L316

function _isProposerPermitted(
    TaikoData.SlotB memory _slotB,
    IAddressResolver _resolver
)
    private
    view
    returns (bool)
{
    if (_slotB.numBlocks == 1) {
        // Only proposer_one can propose the first block after genesis
        address proposerOne = _resolver.resolve("proposer_one", true);
        if (proposerOne != address(0) && msg.sender != proposerOne) {
            return false;
        }
    }

    address proposer = _resolver.resolve("proposer", true);
    return proposer == address(0) || msg.sender == proposer;
}

Here if proposerOne address is correctly proposing the first block after genesis, the following condition is false:

if (proposerOne != address(0) && msg.sender != proposerOne) {

The code then checks msg.sender against proposer role. What instead should have happened was, if msg.sender is proposerOne, it should just return true.

Tools Used

Manual.

Recommended Mitigation Steps

Update the above code block to:

function _isProposerPermitted(
    TaikoData.SlotB memory _slotB,
    IAddressResolver _resolver
)
    private
    view
    returns (bool)
{
    address proposer;
    if (_slotB.numBlocks == 1) {
        // Only proposer_one can propose the first block after genesis
        proposer = _resolver.resolve("proposer_one", true);
    } else {
        proposer = _resolver.resolve("proposer", true);
    }

    return proposer == address(0) || msg.sender == proposer;
}

If the intention is to fallback on proposer role if proposerOne is set to address(0), then this should be used:

function _isProposerPermitted(
    TaikoData.SlotB memory _slotB,
    IAddressResolver _resolver
)
    private
    view
    returns (bool)
{
    if (_slotB.numBlocks == 1) {
        // Only proposer_one can propose the first block after genesis
        address proposerOne = _resolver.resolve("proposer_one", true);
-       if (proposerOne != address(0) && msg.sender != proposerOne) {
-           return false;
+       if (proposerOne != address(0)) {
+           return msg.sender == proposerOne;
        }
    }

    address proposer = _resolver.resolve("proposer", true);
    return proposer == address(0) || msg.sender == proposer;
}

Assessed type

Access Control