search

LayerZero-Labs / LayerZero-v2

Other
492 stars 312 forks source link

BUG: Backdoor Execution possible #72

Closed abhi3700 closed 15 hours ago

abhi3700 commented 1 month ago

Description

A trusted bridge between 2 contracts (on 2 different chains) could verify & execute an encoded message without it actually been sent from the source chain. For instance, Alice (from Nova) didn't send wTSSC to itself/Bob (on Sepolia), but the receiver (Alice/Bob) received because of Bridge's verification and execution, given the OApp chose the set of malicious DVNs.

One can watch this video 🎬 as a demo to understand. In the video, the bridge admin (potential hacker) just executed 2 messages without it actually been sent from the source chain.

Old videos to get more context:

There are 2 repos where u can find the code:

abhi3700 commented 1 month ago

Sharing the discussion thread here from LZ team & community:

image image image image image image image image image image
abhi3700 commented 1 month ago

Issue (still open)

"Any malicious bridge pretending to be a genuine, if could somehow (showcasing different packets sending from multiple contracts) get a potential token contract (with high price value) get themselves added into their OApp/OFT/ONFT's DVN Security stack, the project suffers potentially billions of dollars of losses."

Potential solution

"LZ should introduce (sooner) their own LZ token and create kind of blockchain validators-like ecosystem with incentivization. That way it won't be so scattered."

abhi3700 commented 1 month ago

Reported to Bug Bounty program as well.

abhi3700 commented 1 month ago

Discord chat post Bug Report submission:

image image image image image

Currently, there are 2 main issues/disclaimer for developers using LZ approach as cross-chain solution:

  1. LZ is (kind of) centralized with few DVNs available for message verification before its execution.
  2. An LZ OApp developer needs to apply due diligence before setting its DVN security stack.
bholcomb8 commented 15 hours ago

This has been hashed out on discord and is not a vulnerability. Oapp developers must choose the amount of security they want for their use case and pay for said security.