search

code-423n4 / 2021-07-connext-findings

0 stars 0 forks source link

Unchangeable chain ID information #66

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

shw

Vulnerability details

Impact

The chainId information included in the TransactionManager is immutable, i.e., it could not change after the contract is deployed. However, if a hard fork happens in the future, the contract would become invalid on one of the forked chains because the chain ID has changed.

Proof of Concept

Referenced code: TransactionManager.sol#L73 TransactionManager.sol#L79

Recommended Mitigation Steps

Add a function that allows the admin to set the chainId variable if a hard fork happens.

LayneHaber commented 3 years ago

This is a potential issue in the case of a hard fork, but we will not address it for the following reasons:

  1. It is reasonable to assume the participants will want their funds to remain consistent on the canonical chain, which should keep the same chainId in the event of a fork
  2. Creating an admin function to reset the chainId gives admins a huge amount of power over the system itself
  3. There would still be a race between hard fork activation and updating the chainId that could result in unpredictable transaction behavior

Instead, the course of action is to redeploy the contracts with the correct chainId.