Decent - boredpukar's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20

Vulnerability details

Impact

The setRouter function in DcntEth can be called and set by anyone.

Proof of Concept

The contract uses multiple set of modifiers, such as onlyRouter, onlyOwner, etc. to restrict access to sensitive functions.

However, this setRouter function currently lacks access control, which means any address can call it and set the router. This is a significant security risk and should be restricted to the contract owner or another trusted entity.

    /**
     * @param _router the decentEthRouter associated with this eth
     */
     // @audit - can be called and set by anyone.
    function setRouter(address _router) public {
        router = _router;
    }

Tools Used

Manual Review

Recommended Mitigation Steps

Secure the setRouter function by implementing proper access control to prevent unauthorized addresses from modifying the router.

    /**
     * @param _router the decentEthRouter associated with this eth
     */
     // @audit - can be called and set by anyone.
-    function setRouter(address _router) public {
+    function setRouter(address _router) public onlyOwner {
        router = _router;
    }

Assessed type

Access Control