DecentEthRouter::bridge/bridgeWithPayload can directly be called, which bypasses UTB main entry point with signature

[c4-bot-9]

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentEthRouter.sol#L218-L224

Vulnerability details

Impact

The flow to swapAndBridge/bridgeAndSwap assets is long and starts in UTB contract, where participant provides authenticator signature:
https://github.com/code-423n4/2024-01-decent/blob/07ef78215e3d246d47a410651906287c6acec3ef/src/UTB.sol#L259-L266
The problem is that a malicious actor can directly call DecentEthRouter::bridge with unchecked payload data, which means that it can be anything. For example - giving allowance for some ERC20 token from DescentExecutor to the attacker.
https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DecentBridgeExecutor.sol#L61
Another example is provided data, which is not checked by the signer, but reaches the following line and continues down the flow inside BridgeAdapter::receiveFromBridge and UTB::receiveFromBridge

• Impact is bypassing UTB calldata checks and fee calculations
• Possibility of executing malicious actions on the behalf of executor contract.

Proof of Concept

One example is:

1. Malicious actor encodes "abi.encodeWithSelector(IERC20(WETH).approve.selector,maliciousActor,uint256.max)" and provide it as a payload to bridgeWithPayload
2. The call is bridged and reaches the executor, which runs the provided calldata.
3. Now the malicious actor can withdraw WETH from the contract, if by any chance there is some left.

Tools Used

Manual Review

Recommended Mitigation Steps

Add a modifier on DecentEthRouter::bridge/bridgeWithPayload so only BridgeAdapter can access it

Assessed type

Access Control

[c4-pre-sort]

raymondfam marked the issue as sufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #15

[c4-judge]

alex-ppg marked the issue as not a duplicate

[c4-judge]

alex-ppg marked the issue as duplicate of #221

[c4-judge]

alex-ppg marked the issue as satisfactory

[c4-judge]

alex-ppg marked the issue as duplicate of #647