Decent - piyushshukla's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L19

Vulnerability details

Impact

security vulnerability in the setRouter function of the DcntEth contract. The setRouter function is marked as public, which means that anyone can call it and potentially change the router address, leading to unauthorized access and potential exploitation of the contract.

Proof of Concept

setRouter function is public and lacks proper authorization checks. This allows any address to call the function and update the router address, potentially compromising the security of the contract.

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L19C2-L23C1

function setRouter(address _router) public onlyOwner { router = _router; }

Tools Used

Recommended Mitigation Steps

setRouter function to include an authorization check, allowing only authorized addresses to modify the router variable. An example is provided above, where the onlyOwner modifier is used to restrict access to the contract owner

modifier onlyOwner() { require(msg.sender == owner(), "Not the contract owner"); _; }

function setRouter(address _router) public onlyOwner { router = _router; }

Assessed type

Invalid Validation