Cudos contest - ch13fd357r0y3r's results

Lines of code

https://github.com/code-423n4/2022-05-cudos/blob/de39cf3cd1f1e1cf211819b06d4acf6a043acda0/solidity/contracts/Gravity.sol#L611

Vulnerability details

Impact

The attacker could create the Fake Cosomos ERC20 token. If Gravity.sol is on-chain before the deployment of Real Cosmos ERC20 token, the impact is worse.

Proof of Concept

Anyone Could Call deployERC20() function and deploy the Fake Cosmos ERC20 Token.

Below Snipped is Vulnerable:

	function deployERC20(
		string memory _cosmosDenom,
		string memory _name,
		string memory _symbol,
		uint8 _decimals
	) public {
		// Deploy an ERC20 with entire supply granted to Gravity.sol
		CosmosERC20 erc20 = new CosmosERC20(address(this), _name, _symbol, _decimals);

		// Fire an event to let the Cosmos module know
		state_lastEventNonce = state_lastEventNonce.add(1);
		emit ERC20DeployedEvent(
			_cosmosDenom,
			address(erc20),
			_name,
			_symbol,
			_decimals,
			state_lastEventNonce
		);
	}

Recommended Mitigation Steps

Can Implement AccessControl on deployERC20() function.