Anchor contest - cccz's results

Lines of code

https://github.com/code-423n4/2022-02-anchor/blob/main/contracts/cross-chain-contracts/ethereum/CrossAnchorBridge.sol#L177-L201

Vulnerability details

Impact

When the handleToken method is called in the CrossAnchorBridge contract, the address of the token is not restricted. When the user uses fee-on-transfer tokens, the actual number of tokens received by the contract will be less than the amount, and when the transferTokens method of the WormholeTokenBridge contract is called, tokens of other users will be transferred.

Proof of Concept

https://github.com/code-423n4/2022-02-anchor/blob/main/contracts/cross-chain-contracts/ethereum/CrossAnchorBridge.sol#L177-L201

Tools Used

None

Recommended Mitigation Steps

Consider getting the received amount by calculating the difference of token balance (using balanceOf) before and after the transferFrom.