Magnificent Cerulean Tardigrade - Actor can frontrun lz_receive and steal users’ withdrawal

[sherlock-admin3]

Magnificent Cerulean Tardigrade

Medium

Actor can frontrun lz_receive and steal users’ withdrawal

Summary

Missing receiver check will cause the lz_receive to be frontrunnable as malicious actors will be able to call it with any user_deposit_wallet.

Root Cause

In oapp_lz_receive:111 there is a missing check of receiver and user_deposit_wallet's authority, which allows lz_receive to be called with a user_deposit_wallet that doesn't belong to the receiver.

Internal pre-conditions

Non needed

External pre-conditions

1. The PDA payload_hash of layerzero’s endpoint has to be set, in order for the following require statement to pass.

   require!(
   payload_hash == ctx.accounts.payload_hash.hash,
   LayerZeroError::PayloadHashNotFound
   );

2. It has to frontrun a legitimate call to lz_receive

Attack Path

1. Legitimate user initiates the withdrawal process
2. Attacker frontruns the call to lz_receive with the same params and accounts except the user_deposit_wallet which will be the attacker’s token account.

Impact

The user which initiated the withdrawal process suffers a loss equal to the withdrawal amount requested.

PoC

No response

Mitigation

Add a check that the user_deposit_wallet’s authority is equal to the receiver.