Rigor Protocol contest - panprog's results

Lines of code

https://github.com/code-423n4/2022-08-rigor/blob/5ab7ea84a1516cb726421ef690af5bc41029f88f/contracts/Project.sol#L391-L403

Vulnerability details

Impact

In all places where the signature is required, but msg.sender can be anyone, the same actions can be replayed by re-using the same signature with the same data. This can cause multiple problems, which allows both to corrupt the processes, lock usage or even steal money by malicious actors.

Examples problems:

1. if more than 1 changeOrder action is used (change subcontractor and/or change task cost), subcontractor can send data + signatures of any of the existing changeOrder to change things back to replayed order. If task cost is increased, then reduced, subcontractor can re-send transaction with higher task cost to increase task cost again.
2. addTasks can be re-played (the same transaction data re-sent multiple times) to add a lot of the same tasks to the projects, which will create problems to builder and render the project unusable (as adding funding might fund wrong tasks, real project cost will be different etc)
3. setComplete can be re-played, and coupled with changeOrder bug this allows to steal money by malicious subcontractor (more details in a separate changeOrder bug report)

Proof of Concept

Copy these to test/Hack.ts and test/utils/hack.ts run: yarn test test/Hack.ts

https://gist.github.com/panprog/e9d5ad24b9bdf4ea6efabad5da385d0b

Recommended Mitigation Steps

Consider adding nonce to all signed messages to prevent replaying them.