Decent - wangxx2026's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20-L22 https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L8-L11 https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L294-L299 https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L285-L291 https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L24-L26

Vulnerability details

Impact

It is possible to steal the weth of DecentEthRouter contracts

Proof of Concept

Since setRouter can be accessed by anyone.

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20-L22

    function setRouter(address _router) public {
        router = _router;
    }

By calling setRouter,the router can be modified to a contract controlled by a bad user, and then run mint to cast any number of tokens for the bad user. After the mint runs, the router is then switched back to the DecentEthRouter contract.

Then, through the redeemEth or redeemWeth methods, the weth of the DecentEthRouter contract can be extracted

Tools Used

Manual Review

Recommended Mitigation Steps

Restrict access to the setRouter by adding the modifier onlyOwner

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/UTB.sol#L186-L188 https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/bridge_adapters/StargateBridgeAdapter.sol#L61-L67 https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/UTB.sol#L311-L319 https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/UTB.sol#L134-L162

Vulnerability details

Impact

Loss of users due to fixed cross-chain transaction costs

Proof of Concept

With StargateBridgeAdapter.getBridgedAmount we can see that the amountIn transferred to the target chain is fixed and reduced by 6/10,000. this part is used to pay the cross-chain fees. The problem is, if the cross-chain fee is less than 6/10000, the extra amount will be locked in the target chain and can't be transferred out.

https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/bridge_adapters/StargateBridgeAdapter.sol#L61-L67
    function getBridgedAmount(
        uint256 amt2Bridge,
        address /*tokenIn*/,
        address /*tokenOut*/
    ) external pure returns (uint256) {
        return (amt2Bridge * (1e4 - SG_FEE_BPS)) / 1e4;
    }

The process of cross-chain transaction through StargateBridgeAdapter is to make a pre-cross-chain transaction first. The amoutOut of the pre-cross-chain transaction is used as the amoutIn of the cross-chain transaction, and a certain amount of fee will be deducted through StargateBirdge. https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/UTB.sol#L181-L188

        SwapParams memory newPostSwapParams = abi.decode(
            instructions.postBridge.swapPayload,
            (SwapParams)
        );

        newPostSwapParams.amountIn = IBridgeAdapter( 
            bridgeAdapters[instructions.bridgeId]
-->       ).getBridgedAmount(amountOut, tokenOut, newPostSwapParams.tokenIn); // Reduce by 6/10,000

The amoutOut after the deduction is used to control the slippage. https://github.com/code-423n4/2024-01-decent/blob/011f62059f3a0b1f3577c8ccd1140f0cf3e7bb29/src/bridge_adapters/StargateBridgeAdapter.sol#L170-L180

        router.swap{value: msg.value}(
            getDstChainId(additionalArgs), //lzBridgeData._dstChainId, // send to LayerZero chainId
            getSrcPoolId(additionalArgs), //lzBridgeData._srcPoolId, // source pool id
            getDstPoolId(additionalArgs), //lzBridgeData._dstPoolId, // dst pool id
            refund, // refund adddress. extra gas (if any) is returned to this address
            amt2Bridge, // quantity to swap
--->            (amt2Bridge * (10000 - SG_FEE_BPS)) / 10000, // the min qty you would accept on the destination, fee is 6 bips
            getLzTxObj(additionalArgs), // additional gasLimit increase, airdrop, at address
            abi.encodePacked(getDestAdapter(dstChainId)),
            bridgePayload // bytes param, if you wish to send additional payload you can abi.encode() them here
        );

The amoutOut obtained by stargateBirdge will be greater than or equal to (amt2Bridge * (10000 - SG_FEE_BPS)) / 10000. equal to this is not a problem, but greater than this will result in excess assets not being handled appropriately.

The rate for stargateBirdge is variable. If stargateBirdge's rate is lowered, the lowered rate will not benefit the user, but will be locked in the contract

Tools Used

Manual Review

Recommended Mitigation Steps

When receiving transactions sent from other chains via receiveFromBridge, consider the case where the amount sent is greater than postBridge.amountIn to avoid being locked in the contract.

Also the rate(SG_FEE_BPS) should be settable to accommodate stargateBirdge rate changes

Assessed type

Token-Transfer

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/07ef78215e3d246d47a410651906287c6acec3ef/src/bridge_adapters/DecentBridgeAdapter.sol#L81-L125 https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L171 https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L148-L194

Vulnerability details

Impact

Excess gas returned will be locked in the contract

Proof of Concept

In the process of initiating a request to another chain, through the DecentBridgeAdapter.bridge method, call router.bridgeWithPayload while assembling the call to the sendAndCall method, we see that the refundAddress uses msg.sender.

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L170-L174

        ICommonOFT.LzCallParams memory callParams = ICommonOFT.LzCallParams({
-->       refundAddress: payable(msg.sender), // Refunds received by msg.sender will be locked.
            zroPaymentAddress: address(0x0),
            adapterParams: adapterParams
        });

Now, msg.sender is a DecentBridgeAdapter contract, and there is no method of extracting native tokens from the DecentBridgeAdapter contract. This contract is just a temporary token storage contract during the transaction process. After the excess gas is returned, it will be locked.

Tools Used

Manual Review

Recommended Mitigation Steps

Add the refundAddress parameter to the bridgeWithPayload method to allow for refunds.

Assessed type

ETH-Transfer