Maia DAO Ecosystem - yellowBirdy's results

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/BranchPort.sol#L158-L169 https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/BranchPort.sol#L172-L186

Vulnerability details

Impact

BranchPort.manage allows a registered Strategy to withdraw certain amounts of enabled strategy tokens. It validates access rights ie. if called by a strategy registered for the requested token. It however doesn't check if the token itself is currently enabled.

Conversely BranchPort.replenishTokens allows to force withdraw managed tokens from a strategy. It however performs a check if the token is currently an active strategy token.

Strategy token may be disabled by toggleStrategyToken() even if there are active strategies managing it active. In such case these strategies will still be able to withdraw the tokens with calls to manage() while replenishTokens will not be callable on them and thus tokens won't be force returnable.

Tools Used

Pen and Paper.

Recommended Mitigation Steps

1. Add check on enabled strategy token in manage()
2. Validate getPortStrategyTokenDebt[_strategy][_token] > 0 instead of !isStrategyToken[_token] in replenishReserves()

Assessed type

Access Control

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/BranchBridgeAgent.sol#L1006-L1011 https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/lib/AnycallFlags.sol#L11

Vulnerability details

Impact

IAnycallProxy().anyCall() operates under one of two modes of taking fees, namely fees are taken either on source or on the destination chain. Fee mode is decided by the caller with an appropriate value of the fourth parameter, ie. uint256 _flag . Values 0,4 denote the SOURCE chain. Such invocation require ether to be send along (IAnycallProxy().anyCall() is payable) and in case of insufficient value being sent will fail.

    function anyCall(
        address _to,
        bytes calldata _data,
        uint256 _toChainID,
        uint256 _flags,
        bytes calldata _extdata
    ) external payable;

BranchBridgeAgent._performCall() invokes anyCall() with AnycallFlags.FLAG_ALLOW_FALLBACK which is defined as 0x1 << 2 ie 4

source: BranchBridgeAgent.sol

    function _performCall(bytes memory _calldata) internal virtual {
        //Sends message to AnycallProxy
        IAnycallProxy(localAnyCallAddress).anyCall(
            rootBridgeAgentAddress, _calldata, rootChainId, AnycallFlags.FLAG_ALLOW_FALLBACK, ""
        );
    }

source: AnycallFlags.sol

    uint256 public constant FLAG_ALLOW_FALLBACK = 0x1 << 2;

Consequently all cross bridge requests will fail.

Tools Used

Manual review, Multichain documentation: (Link to anyCall flags definition)[https://docs.multichain.org/developer-guide/anycall-v7/quickstart-cross-chain-text-example]

Recommended Mitigation Steps

Judging from the RootBridgeAgent.anyExecute() implementation the intended mode is to pay fees on the destination chain (with fallback enabled). Under this assumption _flag = 6 should be passed ie. AnycallFlags.FLAG_ALLOW_FALLBACK_DST

Assessed type

Other