Cudos contest - jah's results

Lines of code

https://github.com/code-423n4/2022-05-cudos/blob/de39cf3cd1f1e1cf211819b06d4acf6a043acda0/solidity/contracts/Gravity.sol#L254

Vulnerability details

Impact

checkValidatorSignatures should check if the cumlativPower is greater than or equal to the threshold as threshold is 2/3 of the validators and if exact number threholders validators sign the message it will not be executed because it it checking if the cumlativPower is greater than the threshold on line 247 and 255 require( cumulativePower > _powerThreshold, );

Proof of Concept

https://github.com/code-423n4/2022-05-cudos/blob/de39cf3cd1f1e1cf211819b06d4acf6a043acda0/solidity/contracts/Gravity.sol#L254

Tools Used

Manual

Recommended Mitigation Steps

use require( cumulativPower >= _powerThrehold

Lines of code

https://github.com/code-423n4/2022-05-cudos/blob/de39cf3cd1f1e1cf211819b06d4acf6a043acda0/solidity/contracts/Gravity.sol#L600

Vulnerability details

Impact

The sendToCosmos function of Gravity transfers _amount of _tokenContract from the sender using the function safeTransferFrom. If the transferred token is a transfer-on-fee/deflationary token, the actually received amount could be less than _amount. However, since _amount is passed as a parameter of the SendToCosmosEvent event, the Cosmos side will think more tokens are locked on the Ethereum side.

Proof of Concept

https://github.com/code-423n4/2021-08-gravitybridge-findings/issues/62

Tools Used

Manual

Recommended Mitigation Steps

calculate the the contract balance before and after depositing

Impact

veryfySig will always return address(0) if the signature is not correct so it is better to check if the returned value is not address(0)

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Manual

Recommended Mitigation Steps

check if the returned value is not address(0)