search

KuChainNetwork / Project-Deluge

Identifying technical vulnerabilities
6 stars 2 forks source link

Withdraw Account can be empty #15

Open ghost opened 4 years ago

ghost commented 4 years ago

Describe The Bug In distribution module, delegator's withdraw Account can be empty when the event like unbonding or redelegation happen, rewarding coins will be burn.

In other words, Adversary can burn coins by a malicious transaction without the signature of coin's creator.

Code Snippets validateBasic of setWithdrawAccount hasn't be implemented. malicious transactions with empty withdrawAccount will be preformed normally.

setWithdrawAccount structs look like this

type MsgSetWithdrawAccountIdData struct {
    DelegatorAccountid chainType.AccountID 
    WithdrawAccountid  chainType.AccountID 
}

Input/Output

  1. input command line like this: ./build/ktscli tx kudistribution set-withdraw kratos --keyring-backend test --chain-id testing --home ./testing/cli/ --from kratos

  2. output a normally successful response

To Reproduce

  1. found func GetCmdSetWithdrawAddr(cdc *codec.Codec) *cobra.Command { in x/distribution/client/cli.go modify cobra.ExactArgs(2) into cobra.ExactArgs(1) modify withdrawAccId, err := chainType.NewAccountIDFromStr(args[0]) into withdrawAccId, err := chainType.NewAccountIDFromStr("")

2.remake ktscli

3.run command like this ./build/ktscli tx kudistribution set-withdraw kratos --keyring-backend test --chain-id testing --home ./testing/cli/ --from kratos and we can see the normal response. image

  1. finally check your withdraw addr with command ./build/ktscli query kudistribution whithdraw-addr kratos image

as above, we set the withdrawAddr to empty.

Expected Behavior kratos need intact ValidateBasic function which be called in the AnteHandler for distribution module

Desktop

Additional Context the difference between issue#14 to issue#15 is that there wasn't any implementation of ValidateBasic for distribution in issue#15 at all.

Contact Information congfei.li@chaitin.com

Pisces-Anjou commented 4 years ago

Hi

Thanks for your submission. We have tested the issue you mentioned and did reproduce it. This is a valid vulnerability. After evaluation, this vulnerability has been graded as P3. Please pay attention to the announcement and your email to get your rewards. Thanks for your attention and contribution. Please keep trying and help us improve our chain.

Regards KuChain Team