Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unclear usage of payable functions involved in the "bridge in" flow #112

Closed
code423n4 opened this issue Oct 22, 2022 · 2 comments
Closed

Unclear usage of payable functions involved in the "bridge in" flow #112

code423n4 opened this issue Oct 22, 2022 · 2 comments
Labels
bug Something isn't working duplicate This issue or pull request already exists QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax

Comments

@code423n4
Copy link
Contributor

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/module/LayerZeroModule.sol#L185
https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/module/LayerZeroModule.sol#L221
https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/HolographOperator.sol#L420
https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/HolographOperator.sol#L465

Vulnerability details

The function lzReceive in LayerZeroModule is marked as payable but doesn't forward the value to the operator when calling crossChainMessage. The operator forwards the value to the bridge in the executeJob function (it first forwards the value to the nonRevertingBridgeCall function then this function forwards it again in the low level code in line 465), but this value corresponds to the value sent by the originator of the job execution (the operator in charge of this job) and isn't related to the event received in the LayerZeroModule contract.
@code423n4 code423n4 added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working labels Oct 22, 2022
code423n4 added a commit that referenced this issue Oct 22, 2022
@code423n4
adriro issue #112
89f10ac
@gzeoneth
Copy link
Member

Duplicate of #395

@gzeoneth gzeoneth marked this as a duplicate of #395 Oct 31, 2022
@gzeoneth gzeoneth added the duplicate This issue or pull request already exists label Oct 31, 2022
@gzeoneth gzeoneth added QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax and removed 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value labels Nov 21, 2022
@gzeoneth
Copy link
Member

Consider with #107

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working duplicate This issue or pull request already exists QA (Quality Assurance) Assets are not at risk. State handling, function incorrect as to spec, issues with clarity, syntax
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@code423n4 @gzeoneth