search

sherlock-audit / 2024-09-orderly-network-solana-contract-judging

0 stars 0 forks source link

Radiant Punch Dalmatian - Attacker can steal funds by withdrawing a token different from the request withdrawal token #152

Open sherlock-admin2 opened 4 days ago

sherlock-admin2 commented 4 days ago

Radiant Punch Dalmatian

Medium

Attacker can steal funds by withdrawing a token different from the request withdrawal token

Summary

The solana_vault::lz_receive function does not the check that the deposit_token mint account is the token mint corresponding to the token_hash in the withdrawal message being processed. An attacker can supply different token mint as the deposit_token mint account than in the message. The vault would transfer these tokens instead of the actual tokens.

Essentially, an attacker withdraws one token on the Orderly chain and receives a different token of same amount on Solana side. Attacker profits from the difference in the value of the two accounts.

The LayerZero V2 separates the delivery and execution of the messages. As a result, anyone can call solana_vault::lz_receive function once the withdrawal message has been verified by LZ DVN's and has been delivered.

This allows an attacker to call lz_receive with their own accounts and the verified message.

Root Cause

The solana_vault::lz_receive instruction does not check deposit_token account is the mint account corresponding to the token_hash in the withdrawal message.

https://github.com/sherlock-audit/2024-09-orderly-network-solana-contract/blob/main/solana-vault/packages/solana/contracts/programs/solana-vault/src/instructions/oapp_instr/oapp_lz_receive.rs#L56-L57

Internal pre-conditions

  1. vault_authority owns more than one token, USDC and some X.

This is possible if solana_vault adds support for tokens other than USDC as indicated by code comments:

https://github.com/sherlock-audit/2024-09-orderly-network-solana-contract/blob/main/solana-vault/packages/solana/contracts/programs/solana-vault/src/state/oapp_state/oapp_config.rs#L11-L13

External pre-conditions

No response

Attack Path

  1. solana_vault has collected deposits of 1 million USDC. vault_authority owns 1 million USDC
  2. OApp is reinitialized with X token that has 6 decimals and value of 0.5 USD.
  3. Attacker deposits 100k X tokens and the ledger is updated.
  4. Attacker initiates withdrawal of the deposited 100k X tokens
    • SolConnector sends the withdrawal message.
    • LZ DVN's has verified the message and updated the endpoint program
  5. Attacker calls lz_receive function with the verified message but sets
    • deposit_token mint to the USDC mint and the ATA accounts to the USDC mint accounts
  6. Vault transfers 100k USDC tokens instead of X tokens
  7. Attacker deposited low value token and withdrawn more valuable token.

Impact

Attacker can steal protocol tokens

PoC

No response

Mitigation

No response