Anyone can send cross-chain transactions without paying fees to Decent

[c4-bot-8]

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L197-L234

Vulnerability details

Impact

In https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L197-L234, anyone can call bridge and bridgeWithPayload

    function bridgeWithPayload(
        uint16 _dstChainId,
        address _toAddress,
        uint _amount,
        bool deliverEth,
        uint64 _dstGasForCall,
        bytes memory additionalPayload
    ) public payable {
        return
            _bridgeWithPayload(
                MT_ETH_TRANSFER_WITH_PAYLOAD,
                _dstChainId,
                _toAddress,
                _amount,
                _dstGasForCall,
                additionalPayload,
                deliverEth
            );
    }

    /// @inheritdoc IDecentEthRouter
    function bridge(
        uint16 _dstChainId,
        address _toAddress,
        uint _amount,
        uint64 _dstGasForCall,
        bool deliverEth // if false, delivers WETH
    ) public payable {
        _bridgeWithPayload(
            MT_ETH_TRANSFER,
            _dstChainId,
            _toAddress,
            _amount,
            _dstGasForCall,
            bytes(""),
            deliverEth
        );
    }

These functions are meant to be called by the bridge adapter only which is called by UTB which takes a fee, but they can called by anyone as they have no modifiers set.

Therefore, a user can send a cross-chain transaction without paying fees to Decent by directly calling bridge and bridgeWithPayload. A secondary impact is that this will also deplete the ETH / WETH reserves of the router in the destination chain.

Tools Used

Manual Review.

Recommended Mitigation Steps

Add access control checks to these functions (only bridge adapter should call these functions)

Assessed type

Access Control

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[raymondfam]

Fee dodging via the router.

[c4-pre-sort]

raymondfam marked the issue as duplicate of #15

[c4-pre-sort]

raymondfam marked the issue as not a duplicate

[c4-pre-sort]

raymondfam marked the issue as primary issue

[raymondfam]

Bridge dodging that should have access restrictions.

[c4-sponsor]

wkantaros (sponsor) confirmed

[c4-judge]

alex-ppg marked issue #647 as primary and marked this issue as a duplicate of 647

[c4-judge]

alex-ppg marked the issue as satisfactory