BranchBridgeAgent is missing source chain checking.

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L578-L584

Vulnerability details

Impact

According to the LayerZero docs, UAs should check that messages from trusted chain and known address.
https://layerzero.gitbook.io/docs/evm-guides/master/receive-messages

However, BranchBridgeAgent only checks the address and does not verify the source chain. The source chain here should be the root chain (Arbitrum). If there exists a contract on another network with the same address as the RootBridgeAgent on the Arbitrum network, BranchBridgeAgent may consider messages from this contract as legitimate and process them.
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L578-L584

    function lzReceive(uint16, bytes calldata _srcAddress, uint64, bytes calldata _payload) public override {
        address(this).excessivelySafeCall(
            gasleft(),
            150,
            abi.encodeWithSelector(this.lzReceiveNonBlocking.selector, msg.sender, _srcAddress, _payload)
        );
    }

Deploying a contract on another network with the same address as the RootBridgeAgent on the Arbitrum network is a highly challenging task. However, if a hard fork occurs on Arbitrum, and LayerZero decides to support both networks, then there would be a situation where two contracts have identical addresses.

Adding a source chain check can prevent such situations from occurring.

Proof of Concept

In the following test code, we manually modified the ID of the Arbitrum network to simulate a hard fork on the Arbitrum network. Note that this is not a complete testing scripts.

    function testSrcChainId() public {
        switchToLzChain(rootChainId);
        vm.chainId(31337);
        vm.deal(address(this), 200 ether);
        coreRootRouter.removeBranchBridgeAgent(address(avaxMulticallBridgeAgent), address(this), avaxChainId,  GasParams(800_000, 0.03 ether));
        switchToLzChain(avaxChainId);
    }

Tools Used

Foundry

Recommended Mitigation Steps

    function lzReceive(uint16 _srcChainId, bytes calldata _srcAddress, uint64, bytes calldata _payload) public override {
>>>        require(_srcChainId == rootChainId, "source chain error.");
        address(this).excessivelySafeCall(
            gasleft(),
            150,
            abi.encodeWithSelector(this.lzReceiveNonBlocking.selector, msg.sender, _srcAddress, _payload)
        );
    }

Assessed type

Invalid Validation

[c4-pre-sort]

0xA5DF marked the issue as sufficient quality report

[c4-pre-sort]

0xA5DF marked the issue as primary issue

[0xA5DF]

I doubt this qualifies as med since the likelihood of this being exploited is extremely low
But leaving open for sponsor to comment

[c4-sponsor]

0xLightt (sponsor) confirmed

[alcueca]

The preconditions for this vulnerability are too restrictive to warrant a Medium severity.

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as grade-a