The system inherently trusts that each ERC20ProxyDelegator contract will retain its initial authorization for token transfers to the ERC20MultiDelegate contract. However, if this initial authorization is ever altered or removed, the system could face unexpected failures in token transfers. Such a disruption could be exploited by a malicious actor who can interact directly with the proxy contract's ERC20 methods, leading to potential interruptions in the delegation process.
Though the proxy contract sets an initial approval for the ERC20MultiDelegate upon creation, the system doesn't check this approval's persistence during subsequent transfers.
Recommended Mitigation Steps
Introduce checks before token movements to confirm that the proxy contract still maintains its approval for the ERC20MultiDelegate. Implement safeguard mechanisms to ensure that the initial permissions granted to proxy contracts are irreversible or at least shielded from external manipulations. Regularly monitor the proxy contracts' approval states, and if any anomalies are detected, corrective actions should be taken immediately.
Lines of code
https://github.com/code-423n4/2023-10-ens/blob/main/contracts/ERC20MultiDelegate.sol#L16-L19 https://github.com/code-423n4/2023-10-ens/blob/main/contracts/ERC20MultiDelegate.sol#L163-L171
Vulnerability details
Impact
The system inherently trusts that each
ERC20ProxyDelegator
contract will retain its initial authorization for token transfers to theERC20MultiDelegate
contract. However, if this initial authorization is ever altered or removed, the system could face unexpected failures in token transfers. Such a disruption could be exploited by a malicious actor who can interact directly with the proxy contract'sERC20
methods, leading to potential interruptions in the delegation process.Proof of Concept
constructor function and
transferBetweenDelegators
function.Though the proxy contract sets an initial approval for the
ERC20MultiDelegate
upon creation, the system doesn't check this approval's persistence during subsequent transfers.Recommended Mitigation Steps
Introduce checks before token movements to confirm that the proxy contract still maintains its approval for the
ERC20MultiDelegate
. Implement safeguard mechanisms to ensure that the initial permissions granted to proxy contracts are irreversible or at least shielded from external manipulations. Regularly monitor the proxy contracts' approval states, and if any anomalies are detected, corrective actions should be taken immediately.Assessed type
Invalid Validation