-
Notifications
You must be signed in to change notification settings - Fork 17
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Unchecked _srcChainId
Vulnerability in BranchBridgeAgent for Cross-Chain Communication
#771
Comments
0xA5DF marked the issue as sufficient quality report |
0xA5DF marked the issue as duplicate of #855 |
This is the critical part, I doubt the likelihood of this |
alcueca changed the severity to QA (Quality Assurance) |
alcueca marked the issue as grade-b |
Grade-b because the vulnerability exists, but the report is highly speculative. |
Hi @alcueca I believe that the inherent risks associated with this vulnerability, in conjunction with its potential impact, warrant a Medium risk rating. Below are the primary reasons supporting my appeal:
I respectfully urge a re-evaluation of the grading in light of the above points. The decentralized nature, trust model, and potential impact underscore the need for a more accurate risk assessment. I am more than willing to provide any additional information or engage in further discussions to elucidate any aspect of the identified vulnerability and my analysis. I appreciate your time and consideration in revisiting this grading and look forward to your feedback. |
I have no idea how I considered this report to be anything. It's complete gibberish. |
alcueca marked the issue as grade-c |
Lines of code
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L578
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L941-L943
Vulnerability details
Description
The Ulysses scope is a complex cross-chain communication system designed to facilitate secure and efficient message passing between chains. It relies on LayerZero for this purpose, enabling interoperability between various blockchains. However, a vulnerability has been identified in the custom integration with LayerZero.
The 'Root' contracts are intended to be deployed on Arbitrum, while 'Branch' contracts are deployed on several Layer 1 (L1) and Layer 2 (L2) networks, including Ethereum, Polygon, Base, and Optimism. The vulnerability stems from the fact that the protocol does not adequately verify the
chainId
of the source chain when receiving cross-chain messages throughBranchBridgeAgent
.This vulnerability can be opportunistically exploited by a malicious actor with selfish motives, allowing them to impersonate a trusted source, such as the
RootBridgeAgent
on Arbitrum in another LayerZero supported chains. Subsequently, this individual can execute unauthorized actions on the target chain, which may include Ethereum mainnet, Polygon, Base, or Optimism.Impact
To demonstrate the exploitability of this vulnerability, let's consider a hypothetical scenario:
Unauthorized Actions: An opportunistic attacker could exploit this vulnerability to impersonate a trusted source on a different chain by imitating the address of a legitimate
RootBridgeAgent
from Arbitrum. This would enable them to send cross-chain messages toBranchBridgeAgent
on the target chain without adequate verification.Financial Gain: Depending on the nature of the malicious message and the actions it triggers, an attacker might profit financially by depleting the protocol's assets through unauthorized transfers, withdrawals, or other operations.
Disruption: In pursuit of personal gain, an opportunistic attacker could potentially disrupt the normal operation of the protocol by sending malicious messages that induce unintended behaviors or errors, thereby causing protocol instability.
Proof of Concept
To demonstrate this vulnerability, let's consider a hypothetical scenario:
Address Mimicry:
RootBridgeAgent
deployed on Arbitrum.Crafting a Malicious Message:
RootBridgeAgent
from Arbitrum, the attacker sends a malicious cross-chain message through LayerZero toBranchBridgeAgent
on any Maia-supported chain.Bypassing Security Checks:
Resulting Damage:
Tools Used
Recommended Mitigation Steps
For those genuinely interested in addressing this vulnerability and enhancing the security of the Maia Protocol's custom integration with LayerZero, consider the following steps:
Implement Chain ID Verification:
BranchBridgeAgent
contract to include robust verification for thechainId
of the source chain when receiving cross-chain messages inlzReceive
or pass the_srcChainId
tolzReceiveNonBlocking
and preform the check. This should ensure that messages are only accepted from legitimate sources on the correct chain.Align with LayerZero Best Practices:
LzApp
contract.Assessed type
Invalid Validation
The text was updated successfully, but these errors were encountered: