Taiko - lanrebayode77's results

Lines of code

https://github.com/code-423n4/2024-03-taiko/blob/f58384f44dbf4c6535264a472322322705133b11/packages/protocol/contracts/bridge/Bridge.sol#L97-L98 https://github.com/code-423n4/2024-03-taiko/blob/f58384f44dbf4c6535264a472322322705133b11/packages/protocol/contracts/bridge/Bridge.sol#L271

Vulnerability details

Impact

It will be possible for users to make calls to contract addresses that have been banned, which ideally should be impossible.

Proof of Concept

Calls to banned addresses should be impossible.

  /// @notice Ban or unban an address. A banned addresses will not be invoked upon
    /// with message calls.
    /// @param _addr The address to ban or unban.
    /// @param _ban True if ban, false if unban.
    function banAddress(

In processMessage(), there is a check to prevent making calls to a banned address that sends ether to the refund address set by the user.

  // Process message differently based on the target address
            if (
                _message.to == address(0) ||
                _message.to == address(this) ||
                _message.to == signalService ||
                addressBanned[_message.to] //@audit what if refund address is banned too???
            ) {
                // Handle special addresses that don't require actual invocation but
                // mark message as DONE
            @>  refundAmount = _message.value; //value will be refunded 
                _updateMessageStatus(msgHash, Status.DONE); //will be marked done
            } else {

If the user sets _message.refundTo = bannedAddress, eth will be sent there and fallBack can run desired logic based on user parameters.

// Determine the refund recipient
            address refundTo = _message.refundTo == address(0)
                ? _message.destOwner
                : _message.refundTo; //@audit use a banned address and intended call will run when eth is sent

Refund is done here;

// Refund the processing fee
            if (msg.sender == refundTo) {
                refundTo.sendEther(_message.fee + refundAmount);
            } else {
                // If sender is another address, reward it and refund the rest
                msg.sender.sendEther(_message.fee);
                refundTo.sendEther(refundAmount);     
            }

Bypass flow;

1. Admin bans an address for a certain reason to prevent any call from being made to the address.
2. Banned contract address is upgraded to include certain function calls in fallback and requires to be called by just receiving ether.
3. User set _message.refundTo as bannedAddress, no check to prevent this in sendMessage()
4. when a message is processed, a refund to the address triggers the call to the banned address

Tools Used

Manual review

Recommended Mitigation Steps

Add a check to prevent sending ether to a banned address.

Assessed type

Invalid Validation