Maia DAO - Ulysses - zzzitron's results

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/RootBridgeAgent.sol#L175-L199 https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/RootBridgeAgent.sol#L233-L271 https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/VirtualAccount.sol#L85-L112

Vulnerability details

Impact

When a user wants to send funds from Root to Branch they call RootBridgeAgent.callOutAndBridge(). In the case of where this transferral of funds fails, the user can call RootBridgeAgent.retrySettlement(). However, an attacker can abuse the VirtualAccount from the victim by calling VirtualAccount.payableCall() in order to subsequently call RootBridgeAgent.retrySettlement() to claim the funds for themselves by specifying the _recipient to be themself. Thus the attacker steals funds from the user.

Note that the VirtualAccount from the victim user is allowed to call RootBridgeAgent.retrySettlement() because of line 248-250 in RootBridgeAgent:

// RootBridgeAgent.sol
248            if (msg.sender != address(IPort(localPortAddress).getUserAccount(settlementReference.owner))) {
249                revert NotSettlementOwner();
250            }

Proof of Concept

The POC below is doing the following:

• Funds are first bridged from the AVAX branch to root.

• Then subsequently bridged back from root to AVAX branch by MulticallRootRouter using RootBridgeAgent.callOutAndBridge(), which is failing.

• Then the attacker calls VirtualAccount.payableCall() which calls RootBridgeAgent.retrySettlement() and specifying themself as recipient.

• As a result the attacker gets minted the victim users funds on the branch.

https://gist.github.com/zzzitron/ce2a744c3cbe1e4028d650da683d7f13

Tools Used

Manual review

Recommended Mitigation Steps

Consider adding the requiresApprovedCaller access control modifier to VirtualAccount.payableCall() so that the attacker can't abuse this function.

<!-- zzzitron H01 -->

Assessed type

Access Control