Maia DAO - Ulysses - zhaojie's results

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/RootBridgeAgent.sol#L1210 https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/RootPort.sol#L87

Vulnerability details

Impact

Ulysses Protocol is a Omnichain servers,but cannot support non-EVM chains.

Proof of Concept

1. The length of an address for receiving a message cannot exceed 40 bytes. The length of an address for a non-EVM chain must exceed 40 bytes.

if (_srcAddress.length != 40) revert LayerZeroUnauthorizedCaller();

2. The RootPort uses address to store the token address. Address in the evm is incompatible with addresses on other non-EVM chains, so a compatible format is required.

    mapping(address token => bool isGlobalToken) public isGlobalAddress;

Tools Used

vscode

Recommended Mitigation Steps

Modify the address format of cross-chain tokens and modify the limit on the address length when accepting messages.

Assessed type

Other