Anyone can bypass fees in swapAndExecute using receiveFromBridge.

[c4-bot-7]

Lines of code

https://github.com/code-423n4/2024-01-decent/blob/main/src/UTB.sol#L311

Vulnerability details

Impact

Whenever a user wants to call swapAndExecute (which performs a swap and executes a transaction for a user in the same chain), they have to pay a fee via retrieveAndCollectFees modifier.

UTB.sol#L311C1-L319C6

    function swapAndExecute(
        SwapAndExecuteInstructions calldata instructions,
        FeeStructure calldata fees,
        bytes calldata signature
    )
        public
        payable
        retrieveAndCollectFees(fees, abi.encode(instructions, fees), signature)
    {
        _swapAndExecute(
            instructions.swapInstructions,
            instructions.target,
            instructions.paymentOperator,
            instructions.payload,
            instructions.refund
        );
    }

However there is another function that does essentially the same thing without the retrieveAndCollectFees modifier.

UTB.sol#L311C1-L319C6

    function receiveFromBridge(
        SwapInstructions memory postBridge,
        address target,
        address paymentOperator,
        bytes memory payload,
        address payable refund
    ) public {
        _swapAndExecute(postBridge, target, paymentOperator, payload, refund);
    }

Essentially, this means a user can bypass fees in swapAndExecute by using the function receiveFromBridge.

Note that though this function is not payable, _swapAndExecute also accepts ERC-20 tokens, meaning that one can abuse receiveFromBridge to swap ERC-20 tokens and execute transactions without a fee.

Tools Used

Manual Review

Recommended Mitigation Steps

The receiveFromBridge function needs to check if the msg.sender is actually a bridge adapter by using a new storage mapping that stores a boolean whether a given address is a valid bridge adapter.

Assessed type

Access Control

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as primary issue

[raymondfam]

Dodging fee payment via this postBridge call is indeed a loophole.

[c4-sponsor]

wkantaros (sponsor) confirmed

[c4-judge]

alex-ppg marked issue #590 as primary and marked this issue as a duplicate of 590

[c4-judge]

alex-ppg marked the issue as satisfactory