Ondo Finance - lsaudit's results

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/bridge/DestinationBridge.sol#L234-L240

Vulnerability details

Impact

DestinationBridge does not implement a function which removes supported chain. Whenever chain becomes compromised, it is not possible to remove it from chainToApprovedSender.

Proof of Concept

DestinationBridge does not implement any function which allows to remove previously added chain. If chain becomes compromised, there's no way to remove it.

Since there aren't any additional function which removes previously added chain, the only reasonable solution for removing the chain would be calling function addChainSupport() again and overwrite the chain with bytes32(0). That way, function _execute() will see that chain as non-existing one and will revert with ChainNotSupported():

File: contracts/bridge/DestinationBridge.sol

96:    if (chainToApprovedSender[srcChain] == bytes32(0)) {
97:      revert ChainNotSupported();

However, this is impossible, since addChainSupport() does not allow to set chainToApprovedSender[srcChain] to bytes32(0).

File: contracts/bridge/DestinationBridge.sol

  function addChainSupport(
    string calldata srcChain,
    string calldata srcContractAddress
  ) external onlyOwner {
    chainToApprovedSender[srcChain] = keccak256(abi.encode(srcContractAddress));
    emit ChainIdSupported(srcChain, srcContractAddress);
  }

At line 238, chainToApprovedSender[srcChain] is set to value of keccak256(abi.encode(srcContractAddress)). It is not possible to set any srcContractAddress, for which keccak256(abi.encode(srcContractAddress)) will return bytes32(0). Thus calling addChainSupport() on existing chain, we can only change its address, but never remove it.

This proves, that contract does not implement any method to completely remove previously added chain.

Tools Used

Manual code review

Recommended Mitigation Steps

Implement additional function which allows to remove previously added chain. This function should perform delete chainToApprovedSender[srcChain].

Assessed type

Other