-
Notifications
You must be signed in to change notification settings - Fork 17
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Smart Contract calling callOutSignedAndBridge via BranchBridgeAgent can cause loss of fund #872
Comments
0xA5DF marked the issue as duplicate of #877 |
0xA5DF marked the issue as sufficient quality report |
alcueca marked the issue as satisfactory |
alcueca changed the severity to 3 (High Risk) |
alcueca marked the issue as duplicate of #351 |
alcueca marked the issue as partial-50 |
alcueca changed the severity to 2 (Med Risk) |
alcueca marked the issue as selected for report |
alcueca marked the issue as not selected for report |
alcueca marked issue #877 as primary and marked this issue as a duplicate of 877 |
alcueca marked the issue as satisfactory |
alcueca changed the severity to 3 (High Risk) |
Lines of code
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L276
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/RootBridgeAgent.sol#L577
Vulnerability details
Impact
Smart Contract calling callOutSignedAndBridge via BranchBridgeAgent can cause loss of fun
Proof of Concept
One of the cross-chain request pass is that when user calling callOutSignedAndBridge via BranchBridgeAgent
the payload is created
this would trigger the code on RootBridgeAgent.sol
the msg.sender address in source chain (branch bridge agent chain) will be used to either fetch or create a new virtual wallet
and this function has no access control, anyone can trigger this function to create a virtual account for specific user address
and the function will not revert, if wallet does not exist, wallet is created for the user.
the code assume the same address in different blockchain belongs to the same owner
this is mostly true for EOA account
but not true for smart contract address (for example, multisig)
the same address for multisig in different network can belong to different owner
for example https://rekt.news/wintermute-rekt/
the false assumption of a mutlisig smart contract address is controlled by same owner in different network has cost 20M OP lost
the multisig address is controlled by wintermute in mainnet
the attacker observe the OP is sent to the same address in OP network
the attacker manage the get the factory nonce of the gensis safe factory and redeploy the same address in OP network to control the OP token
this could happens to the current implementation of maia dao
a user can observer when a multisig address trigger callOutSignedAndBridge and redeploy the same address in different network (root bridge agent) to control the fund
or it is possible a smart contract in blockchain A does not belong to anyone in blockchain B, in that case, the fund is lost
Tools Used
Manual Review
Recommended Mitigation Steps
let user specify the recipient when calling callOutSignedAndBridge and use the recipient address to fetch virtual account
Assessed type
Token-Transfer
The text was updated successfully, but these errors were encountered: