Decent - th13vn's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20

Vulnerability details

Impact

The vulnerability in the setRouter function poses a critical risk as it allows any address to change the router variable. This means that an attacker could maliciously alter the router address, leading to unauthorized control over critical functions such as mint() tokens.

Proof of Concept

Vulnerable code:

modifier onlyRouter() {
    require(msg.sender == router);
    _;
}
function setRouter(address _router) public {
    router = _router;
}
function mint(address _to, uint256 _amount) public onlyRouter {
    _mint(_to, _amount);
}

The attacker easily call setRouter() with his address. Then, he arbitrary mint amount DcntEth token.

Tools Used

Manual

Recommended Mitigation Steps

The code can be fixed as below:

function setRouter(address _router) public onlyOwner {
    router = _router;
}

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/d562762c3bf58cca7e24171873fb7b6fbfa7b2b5/src/UTB.sol#L311

Vulnerability details

Impact

In the Decent protocol, every user who wants to swap execute must call swapAndExecute(). The function executed the collected fee and verified swap instructions signed by the signer. Unfortunately, the user can bypass paying fees and checking signatures by calling the receiveFromBridge() function, which has no restrictions on paying fees and validating signatures.

Proof of Concept

Vulnerable code:

function receiveFromBridge(
    SwapInstructions memory postBridge,
    address target,
    address paymentOperator,
    bytes memory payload,
    address payable refund
) public {
    _swapAndExecute(postBridge, target, paymentOperator, payload, refund);
}

The user directly call receiveFromBridge() to avoid paying fees and validating signatures.

Tools Used

Manual

Recommended Mitigation Steps

Restrict receiveFromBridge() function is only called by bridge address.

Assessed type

Access Control