Ondo Finance - pontifex's results

Lines of code

https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/bridge/SourceBridge.sol#L61-L82 https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/bridge/DestinationBridge.sol#L85-L114 https://github.com/code-423n4/2023-09-ondo/blob/47d34d6d4a5303af5f46e907ac2292e6a7745f6c/contracts/bridge/DestinationBridge.sol#L337-L353

Vulnerability details

Impact

The msg.sender address from the SourceBridge.burnAndCallAxelar function is used by the DestinationBridge._mintIfThresholdMet function as the TOKEN recipient. However, the msg.sender address will not be controllable by contracts on L2, so any tokens will be lost.

Proof of Concept

The SourceBridge.burnAndCallAxelar function constructs the payload:

79    bytes memory payload = abi.encode(VERSION, msg.sender, amount, nonce++);

The payload then is decoded at the DestinationBridge._execute function and used to save transaction parameters in the txnHashToTransaction mapping as the Transaction(srcSender, amt) structure.

90    (bytes32 version, address srcSender, uint256 amt, uint256 nonce) = abi
91      .decode(payload, (bytes32, address, uint256, uint256));

109    txnHashToTransaction[txnHash] = Transaction(srcSender, amt);

The DestinationBridge._mintIfThresholdMet uses the parameters for the tokens minting:

339    Transaction memory txn = txnHashToTransaction[txnHash];

349      TOKEN.mint(txn.sender, txn.amount);

So if the burnAndCallAxelar function is called by a contract the tokens will be minted to a wrong address (not the contract address at the destination chain ).

Tools Used

Manual review

Recommended Mitigation Steps

Consider specifying recipients for any token transfers or reverting in the case of the sender is not an EOA.

Assessed type

Other