Closed code423n4 closed 1 year ago
Sponsor is already aware of this attack
The current bridge design assumes no tokens are minted in L2 (other than through the bridge), so any submissions showing how an attacker can mint tokens in L2 (without compromising the governor account) would be particularly valuable.
Closing as invalid.
Lines of code
https://github.com/code-423n4/2022-10-thegraph/blob/309a188f7215fa42c745b136357702400f91b4ff/contracts/l2/token/L2GraphToken.sol#L59-L63 https://github.com/code-423n4/2022-10-thegraph/blob/309a188f7215fa42c745b136357702400f91b4ff/contracts/l2/token/L2GraphToken.sol#L80-L83 https://github.com/code-423n4/2022-10-thegraph/blob/309a188f7215fa42c745b136357702400f91b4ff/contracts/l2/gateway/L2GraphTokenGateway.sol#L137-L175
Vulnerability details
Impact
Governor can rug all GRT by setting the gateway to her wallet (Governor may be hacked).
Proof of Concept
First, the Governor set the gateway contract to her wallet
Second, the Governor calls bridgeMint to mint GRT to her own wallet.
Next, the Governor set the gateway contract back to the correct one.
Finally, the Governor bridged all funds to L1 and dump all GRT for ETH
You have written that Does it use a timelock function? No
This means Governor can rug all funds in a matter of minutes. If the governor's wallet gets hacked such as due to using Profanity, all funds will be hacked.
Recommended Mitigation Steps
Timelock must be enforced. If enforced, you can pause the contract on the L1 side before funds have been stolen.