Owners have absolute control over protocol

[code423n4]

Lines of code

https://github.com/code-423n4/2022-03-biconomy/blob/main/contracts/hyphen/LiquidityFarming.sol#L174-L192

Vulnerability details

Impact

Owners have full control over the protocol

Proof of Concept

Owners have full control over:

• executors who perform token transfers on behalf of the destination chain
• reclaiming / withdrawing any tokens (including reward tokens) held by farming contract
• total upgradeability
• instant parameters change (no timelock)
• 1 step owner change (gold standard is 2-step owner change)

Tools Used

Manual review

Recommended Mitigation Steps

Make executors decentralized.
Add TimeLock for parameter changes.

[ankurdubey521]

I agree this is an issue, but in the current iteration of Hyphen it is still a centralized system, therefore there is an implicit trust in the contract owners and executors. A decentralized version of the Hyphen bridge is in the works and will fix these issues.

[pauliax]

I am grouping all the issues related to centralization and owner privilege risks together and making this a primary issue because it is the most generic.