Closed code423n4 closed 1 year ago
https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/gateway/L1GraphTokenGateway.sol#L235
In https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/gateway/L1GraphTokenGateway.sol#L235, the line
token.transferFrom(from, escrow, _amount);
use an arbitrary from address. So an attacker can deposit victim's GTR token on L1, by using from address as victim's address, and receive equivalent tokens on L2 on attacker address.
from
Manual review
Whitelist the function outboundTransfer
outboundTransfer
from is not an arbitrary address, it is calculated to be msg.sender or caller of router function in case it is a router call.
Lines of code
https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/gateway/L1GraphTokenGateway.sol#L235
Vulnerability details
Impact
In https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/gateway/L1GraphTokenGateway.sol#L235, the line
use an arbitrary from address. So an attacker can deposit victim's GTR token on L1, by using
from
address as victim's address, and receive equivalent tokens on L2 on attacker address.Proof of Concept
https://github.com/code-423n4/2022-10-thegraph/blob/main/contracts/gateway/L1GraphTokenGateway.sol#L235
Tools Used
Manual review
Recommended Mitigation Steps
Whitelist the function
outboundTransfer