Decent - stealth's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20-L22

Vulnerability details

The setRouter function in the DcntEth.sol contract is used to set the router of the contract.

The router has access to some critical functions like mint and burn functions which can be used to mint and burn tokens respectively.

However, the setRouter function doesn't have any type of access control mechanism and this function's visibility is public.

Hence, anyone and can call this function and set the router of the DcntEth contract at any time and also mint and burn tokens at their will after they set the router.

Which could lead to a total loss of value for the token.

Impact

• Unauthorized minting/burning of tokens: As anyone can set themselves or any other address as the router of the contract and call mint or burn function from the address they have saved via the setRouter function.

• Missing access controls: As anyone can call this function which without having necessary permissions.

Proof of Concept

This is the current implementation of the setRouter function in the DcntEth.sol contract for reference:

    /**
     * @param _router the decentEthRouter associated with this eth
     */
    function setRouter(address _router) public {
        router = _router;
    }

It is clearly visible that this function's visibility is public and anyone can call this function without any restriction.

Here, I've given a Proof of Concept to reproduce the vulnerability. This vulnerability can be easily identified and reproduced.

Step 1: Call the setRouter function and set your address as the router of the contract.

Step 2: Call mint or burn function to mint tokens to any address or burn tokens from any address at your will.

Tools Used

• Visual Studio Code

Recommended Mitigation Steps

This vulnerability can be resolved by adding a onlyOwner modifier or any other type of access control mechanism in the setRouter function.

Here is the modified code for the function:

function setRouter(address _router) public onlyOwner {
        router = _router;
    }

Git Diff:

@@ -17,7 +17,7 @@ contract DcntEth is OFTV2 {
    /**
     * @param _router the decentEthRouter associated with this eth
     */
-    function setRouter(address _router) public {
+    function setRouter(address _router) public onlyOwner {
        router = _router;
    }

Assessed type

Access Control