BranchBridgeAgent:lzReceive() should check if _srcChainId is rootChainId

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/main/src/BranchBridgeAgent.sol#L578

Vulnerability details

Impact

Attackers can replay calls from the old root chain to branch chains if the root chain is forked.

Proof of Concept

In BranchBridgeAgent:lzReceive(), we ignore the _srcChainId parameter passed from the endpoint, only check the msg.sender is the endpoint, and the message sender is the root bridge agent in requiresEndpoint modifier.

    function lzReceive(uint16, bytes calldata _srcAddress, uint64, bytes calldata _payload) public override {
        address(this).excessivelySafeCall(
            gasleft(),
            150,
            abi.encodeWithSelector(this.lzReceiveNonBlocking.selector, msg.sender, _srcAddress, _payload)
        );
    }

However, this can lead to a replay problem when the root chain forked and added to the LayerZero as a new chain:

1. Alice triggers a message from the root chain R1 to branch chain A. This is a swap call with slippage protection, and the call reverts on the branch router.
2. The root chain R1 is forked with R1 and R2.
3. Alice retried the settlement on R1 and reverted again.
4. Time passed, the slippage protection set in 1 is unpractical. Bob replayed the retrySettlement tx in step 3 on R2, and the bridge agent on chain A received the message from R2. Since the msg.sender is the endpoint and _srcAddress is the root bridge agent address, the call is executed on Chain A and success, which is unexpected by Alice.

Tools Used

Recommended Mitigation Steps

We should make sure BranchBridgeAgent can only get call from the root chain when it's deployed:

    function lzReceive(uint16 _srcChainId, bytes calldata _srcAddress, uint64, bytes calldata _payload) public override {
    require(_srcChainId == rootChainId, "Only accept message from the root chain");

Assessed type

Invalid Validation

[c4-pre-sort]

0xA5DF marked the issue as duplicate of #855

[c4-pre-sort]

0xA5DF marked the issue as sufficient quality report

[c4-judge]

alcueca changed the severity to QA (Quality Assurance)

[c4-judge]

alcueca marked the issue as grade-a