Maia DAO - Ulysses - bronze_pickaxe's results

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/main/src/RootBridgeAgent.sol#L436

Vulnerability details

Impact

In Summer 2022, the LayerZero team updated their chainIds. For example, main-net chainId used to be 1 - which got updated to 101.

Therefore, the team advises every project that incorporates LayerZero to not hardcode the chainId's because they can be updated by the LayerZero team in the future. You can find this advice in their LayerZero Integration Checklist.

Ulysses makes use of chainId's everywhere in the project.

In BranchBridgeAgent.sol, RootBridgeAgent.sol, lzReceive receives the _srcChainId, which is the chainID from the chain that has sent the message. This _srcChainId

The _srchChainId is used everywhere. It is used to update state variables like the executionNonce.

executionState[_srcChainId][nonce] = STATUS_RETRIEVE;

executionState[_srcChainId][_depositNonce] = STATUS_DONE;

executionState[_srcChainId][_depositNonce] = STATUS_DONE;

_srcChainId is also used for checking if localTokens or globalTokens exist, it is used to perform _performFallback.

Ulysses also uses localChainId in multiple contracts. For example, in RootBridgeAgent.sol, localChainID is used to check if destination chainID == localChainId:

if (_dstChainId != localChainId) {

Impact

The project won't be able to function properly anymore, this includes problems like:

• hToken/localToken/GlobalToken validations will stop working.
• funds stuck in Ports.
• unexpected behaviour with state variables.
• BranchBridgeAgent validations will stop working.

Tools Used

Manual Review.

Recommended Mitigation Steps

Add a admin restricted setter to change the ChainId.

Assessed type

Other