search

code-423n4 / 2021-08-gravitybridge-findings

1 stars 0 forks source link

DoS for submitting batches and logic calls #24

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

0xito

Vulnerability details

Impact

when submitbatch is called with a _batchnonce of the maximum unsigned number (type(uint256).max), all future calls will fail due to this check:

require(state_lastBatchNonces[_tokenContract] = type(uint256).max < _batchNonce, "...");

no batches can be submitted again but are still accepted on the cosmos side.

The same issue exists for submitLogicCall and setting args.invalidationNonce = type(uint256).max

Proof of Concept

Tools Used

Recommended Mitigation Steps

the nonces should not be arbitrary, ideally, they are the previous nonce + 1, or within a range of the previous nonce.

jkilpatr commented 2 years ago

duplicate of #32

I'm fine with a high risk classification here. There's a meaningful risk of just screwing this state up by accident.

albertchon commented 2 years ago

I think this deserves a low risk categorization, as it's a duplicate of https://github.com/code-423n4/2021-08-gravitybridge-findings/issues/24