search

kkrt-labs / kakarot

Kakarot is a zkEVM written in Cairo, leveraging the STARK proof system.
https://kakarot.org
MIT License
990 stars 301 forks source link

bug: Kakarot precompiles can be abused by malicious contracts by delegate-calling whitelisted contracts[2] #1562

Open obatirou opened 1 week ago

obatirou commented 1 week ago

Bug Report

Malicious contracts can exploit users to make arbitrary calls to whitelisted contracts on their behalf via delegatecall https://github.com/code-423n4/2024-09-kakarot-findings/issues/38

Fix to implement

Make sure that DualVmToken, L2KakarotMessaging, as well as any other future contract using Kakarot precompiles, make extensive use of noDelegateCall modifiers.

Jemiiah commented 1 week ago

@obatirou pls can I be assigned