Skip to content
This repository has been archived by the owner on Oct 8, 2023. It is now read-only.

obront - All migrated withdrarwals that require more than 135,175 gas may be bricked #93

Open
sherlock-admin opened this issue Apr 7, 2023 · 8 comments
Open

obront - All migrated withdrarwals that require more than 135,175 gas may be bricked #93

sherlock-admin opened this issue Apr 7, 2023 · 8 comments
Labels
Escalation Resolved This issue's escalations have been approved/rejected High A valid High severity issue Reward A payout will be made for this issue

Comments

@sherlock-admin
Copy link
Contributor

obront

high

All migrated withdrarwals that require more than 135,175 gas may be bricked

Summary

Migrated withdrawals are given an "outer" (Portal) gas limit of calldata cost + 200,000, and an "inner" (CrossDomainMessenger) gas limit of 0. The assumption is that the CrossDomainMessenger is replayable, so there is no need to specify a correct gas limit.

This is an incorect assumption. For any withdrawals that require more than 135,175 gas, insufficient gas can be sent such that CrossDomainMessenger's external call reverts and the remaining 1/64th of the gas sent is not enough for replayability to be encoded in the Cross Domain Messenger.

However, the remaining 1/64th of gas in the Portal is sufficient to have the transaction finalize, so that the Portal will not process the withdrawal again.

Vulnerability Detail

When old withdrawals are migrated to Bedrock, they are encoded as calls to L1CrossDomainMessenger.relayMessage() as follows:

func MigrateWithdrawal(withdrawal *LegacyWithdrawal, l1CrossDomainMessenger *common.Address) (*Withdrawal, error) {
	// Attempt to parse the value
	value, err := withdrawal.Value()
	if err != nil {
		return nil, fmt.Errorf("cannot migrate withdrawal: %w", err)
	}

	abi, err := bindings.L1CrossDomainMessengerMetaData.GetAbi()
	if err != nil {
		return nil, err
	}

	// Migrated withdrawals are specified as version 0. Both the
	// L2ToL1MessagePasser and the CrossDomainMessenger use the same
	// versioning scheme. Both should be set to version 0
	versionedNonce := EncodeVersionedNonce(withdrawal.XDomainNonce, new(big.Int))
	// Encode the call to `relayMessage` on the `CrossDomainMessenger`.
	// The minGasLimit can safely be 0 here.
	data, err := abi.Pack(
		"relayMessage",
		versionedNonce,
		withdrawal.XDomainSender,
		withdrawal.XDomainTarget,
		value,
		new(big.Int), // <= THIS IS THE INNER GAS LIMIT BEING SET TO ZERO
		[]byte(withdrawal.XDomainData),
	)
	if err != nil {
		return nil, fmt.Errorf("cannot abi encode relayMessage: %w", err)
	}

	gasLimit := MigrateWithdrawalGasLimit(data)

	w := NewWithdrawal(
		versionedNonce,
		&predeploys.L2CrossDomainMessengerAddr,
		l1CrossDomainMessenger,
		value,
		new(big.Int).SetUint64(gasLimit), // <= THIS IS THE OUTER GAS LIMIT BEING SET
		data,
	)
	return w, nil
}

As we can see, the relayMessage() call uses a gasLimit of zero (see comments above), while the outer gas limit is calculated by the MigrateWithdrawalGasLimit() function:

func MigrateWithdrawalGasLimit(data []byte) uint64 {
	// Compute the cost of the calldata
	dataCost := uint64(0)
	for _, b := range data {
		if b == 0 {
			dataCost += params.TxDataZeroGas
		} else {
			dataCost += params.TxDataNonZeroGasEIP2028
		}
	}

	// Set the outer gas limit. This cannot be zero
	gasLimit := dataCost + 200_000
	// Cap the gas limit to be 25 million to prevent creating withdrawals
	// that go over the block gas limit.
	if gasLimit > 25_000_000 {
		gasLimit = 25_000_000
	}

	return gasLimit
}

This calculates the outer gas limit value by adding the calldata cost to 200,000.

Let's move over to the scenario in which these values are used to see why they can cause a problem.

When a transaction is proven, we can call OptimismPortal.finalizeWithdrawalTransaction() to execute the transaction. In the case of migrated withdrawals, this executes the following flow:

  • OptimismPortal calls to L1CrossDomainMessenger with a gas limit of 200,000 + calldata
  • This guarantees remaining gas for continued execution after the call of (200_000 + calldata) * 64/63 * 1/64 > 3174
  • XDM uses 41,002 gas before making the call, leaving 158,998 remaining for the call
  • The SafeCall.callWithMinGas() succeeds, since the inner gas limit is set to 0
  • If the call uses up all of the avaialble gas (succeeding or reverting), we are left with 158,998 * 1/64 = 2,484 for the remaining execution
  • The remaining execution includes multiple SSTOREs which totals 23,823 gas, resulting in an OutOfGas revert
  • In fact, if the call uses any amount greater than 135,175, we will have less than 23,823 gas remaining and will revert
  • As a result, none of the updates to L1CrossDomainMessenger occur, and the transaction is not marked in failedMessages for replayability
  • However, the remaining 3174 gas is sufficient to complete the transction on the OptimismPortal, which sets finalizedWithdrawals[hash] = true and locks the withdrawals from ever being made again

Impact

Any migrated withdrawal that uses more than 135,175 gas will be bricked if insufficient gas is sent. This could be done by a malicious attacker bricking thousands of pending withdrawals or, more likely, could happen to users who accidentally executed their withdrawal with too little gas and ended up losing it permanently.

Code Snippet

https://github.com/ethereum-optimism/optimism/blob/9b9f78c6613c6ee53b93ca43c71bb74479f4b975/op-chain-ops/crossdomain/migrate.go#L55-L97

https://github.com/ethereum-optimism/optimism/blob/9b9f78c6613c6ee53b93ca43c71bb74479f4b975/op-chain-ops/crossdomain/migrate.go#L99-L119

https://github.com/ethereum-optimism/optimism/blob/9b9f78c6613c6ee53b93ca43c71bb74479f4b975/packages/contracts-bedrock/contracts/L1/OptimismPortal.sol#L315-L412

https://github.com/ethereum-optimism/optimism/blob/9b9f78c6613c6ee53b93ca43c71bb74479f4b975/packages/contracts-bedrock/contracts/universal/CrossDomainMessenger.sol#L291-L383

Tool used

Manual Review

Recommendation

There doesn't seem to be an easy fix for this, except to adjust the migration process so that migrated withdrawals are directly saved as failedMessages on the L1CrossDomainMessenger (and marked as finalizedWithdrawals on the OptimismPortal), rather than needing to be reproven through the normal flow.
@github-actions github-actions bot added the Excluded Excluded by the judge without consulting the protocol or the senior label Apr 10, 2023
@github-actions github-actions bot reopened this Apr 10, 2023
@github-actions github-actions bot added High A valid High severity issue and removed Excluded Excluded by the judge without consulting the protocol or the senior labels Apr 10, 2023
@maurelian
Copy link

maurelian commented Apr 18, 2023 •
edited
Loading

Valid but we believe it to be a medium. There definitely exist edge cases of transactions where this is an issue but the majority of transactions it is not an issue.

Based on the following call trace for a finalization of a withdrawal transaction + the address mapping, we believe that this issue is unable to impact transactions transferring ERC20 tokens through the bridge.

{
  "from": "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266",
  "gas": "0x73bdc",
  "gasUsed": "0x3ebbe",
  "to": "0x5fc8d32690cc91d4c39d9d3abcbd16989f875707",
  "input": "0x8c3152e9000000000000000000000000000000000000000000000000000000000000002000010000000000000000000000000000000000000000000000000000000000000000000000000000000000004200000000000000000000000000000000000007000000000000000000000000dc64a140aa3e981100a9beca4e685f962f0cf6c900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000031b8000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000001e4d764ad0b000100000000000000000000000000000000000000000000000000000000000000000000000000000000000042000000000000000000000000000000000000100000000000000000000000009fe46736679d2d9a65f0992f2272de9f3c7fa6e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000000e40166a07a000000000000000000000000e6e340d132b5f46d1e472debcd681b2abc16e57e0000000000000000000000007c6b91d9be155a6db01f749217d76ff02a7227f2000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb92266000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb922660000000000000000000000000000000000000000000000000de0b6b3a764000000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
  "calls": [
    {
      "from": "0x5fc8d32690cc91d4c39d9d3abcbd16989f875707",
      "gas": "0x70b60",
      "gasUsed": "0x3fb97",
      "to": "0x0dcd1bf9a1b36ce34237eeafef220932846bcd82",
      "input": "0x8c3152e9000000000000000000000000000000000000000000000000000000000000002000010000000000000000000000000000000000000000000000000000000000000000000000000000000000004200000000000000000000000000000000000007000000000000000000000000dc64a140aa3e981100a9beca4e685f962f0cf6c900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000031b8000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000001e4d764ad0b000100000000000000000000000000000000000000000000000000000000000000000000000000000000000042000000000000000000000000000000000000100000000000000000000000009fe46736679d2d9a65f0992f2272de9f3c7fa6e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000000e40166a07a000000000000000000000000e6e340d132b5f46d1e472debcd681b2abc16e57e0000000000000000000000007c6b91d9be155a6db01f749217d76ff02a7227f2000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb92266000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb922660000000000000000000000000000000000000000000000000de0b6b3a764000000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
      "calls": [
        {
          "from": "0x5fc8d32690cc91d4c39d9d3abcbd16989f875707",
          "gas": "0x6b7b4",
          "gasUsed": "0x1c91",
          "to": "0xcf7ed3acca5a467e9e704c703e8d87f634fb0fc9",
          "input": "0x88786272",
          "output": "0x0000000000000000000000000000000000000000000000000000000064370353",
          "calls": [
            {
              "from": "0xcf7ed3acca5a467e9e704c703e8d87f634fb0fc9",
              "gas": "0x689d2",
              "gasUsed": "0x91a",
              "to": "0xa51c1fc2f0d1a1b8494ed1fe312d7c3a78ed91c0",
              "input": "0x88786272",
              "output": "0x0000000000000000000000000000000000000000000000000000000064370353",
              "value": "0x0",
              "type": "DELEGATECALL"
            }
          ],
          "type": "STATICCALL"
        },
        {
          "from": "0x5fc8d32690cc91d4c39d9d3abcbd16989f875707",
          "gas": "0x69a01",
          "gasUsed": "0x2f3",
          "to": "0xcf7ed3acca5a467e9e704c703e8d87f634fb0fc9",
          "input": "0xf4daa291",
          "output": "0x0000000000000000000000000000000000000000000000000000000000000002",
          "calls": [
            {
              "from": "0xcf7ed3acca5a467e9e704c703e8d87f634fb0fc9",
              "gas": "0x67de3",
              "gasUsed": "0x110",
              "to": "0xa51c1fc2f0d1a1b8494ed1fe312d7c3a78ed91c0",
              "input": "0xf4daa291",
              "output": "0x0000000000000000000000000000000000000000000000000000000000000002",
              "value": "0x0",
              "type": "DELEGATECALL"
            }
          ],
          "type": "STATICCALL"
        },
        {
          "from": "0x5fc8d32690cc91d4c39d9d3abcbd16989f875707",
          "gas": "0x6953a",
          "gasUsed": "0x1d86",
          "to": "0xcf7ed3acca5a467e9e704c703e8d87f634fb0fc9",
          "input": "0xa25ae557000000000000000000000000000000000000000000000000000000000000000b",
          "output": "0x3cef4cf4a4886782e55500db2d25325cb17007808ba2d44e0e37e7194f485da2000000000000000000000000000000000000000000000000000000006437057000000000000000000000000000000000000000000000000000000000000000f0",
          "calls": [
            {
              "from": "0xcf7ed3acca5a467e9e704c703e8d87f634fb0fc9",
              "gas": "0x6792d",
              "gasUsed": "0x1b9a",
              "to": "0xa51c1fc2f0d1a1b8494ed1fe312d7c3a78ed91c0",
              "input": "0xa25ae557000000000000000000000000000000000000000000000000000000000000000b",
              "output": "0x3cef4cf4a4886782e55500db2d25325cb17007808ba2d44e0e37e7194f485da2000000000000000000000000000000000000000000000000000000006437057000000000000000000000000000000000000000000000000000000000000000f0",
              "value": "0x0",
              "type": "DELEGATECALL"
            }
          ],
          "type": "STATICCALL"
        },
        {
          "from": "0x5fc8d32690cc91d4c39d9d3abcbd16989f875707",
          "gas": "0x6759c",
          "gasUsed": "0x2f3",
          "to": "0xcf7ed3acca5a467e9e704c703e8d87f634fb0fc9",
          "input": "0xf4daa291",
          "output": "0x0000000000000000000000000000000000000000000000000000000000000002",
          "calls": [
            {
              "from": "0xcf7ed3acca5a467e9e704c703e8d87f634fb0fc9",
              "gas": "0x65a10",
              "gasUsed": "0x110",
              "to": "0xa51c1fc2f0d1a1b8494ed1fe312d7c3a78ed91c0",
              "input": "0xf4daa291",
              "output": "0x0000000000000000000000000000000000000000000000000000000000000002",
              "value": "0x0",
              "type": "DELEGATECALL"
            }
          ],
          "type": "STATICCALL"
        },
        {
          "from": "0x5fc8d32690cc91d4c39d9d3abcbd16989f875707",
          "gas": "0x6053e",
          "gasUsed": "0x306f9",
          "to": "0xdc64a140aa3e981100a9beca4e685f962f0cf6c9",
          "input": "0xd764ad0b000100000000000000000000000000000000000000000000000000000000000000000000000000000000000042000000000000000000000000000000000000100000000000000000000000009fe46736679d2d9a65f0992f2272de9f3c7fa6e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000000e40166a07a000000000000000000000000e6e340d132b5f46d1e472debcd681b2abc16e57e0000000000000000000000007c6b91d9be155a6db01f749217d76ff02a7227f2000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb92266000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb922660000000000000000000000000000000000000000000000000de0b6b3a764000000000000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
          "calls": [
            {
              "from": "0xdc64a140aa3e981100a9beca4e685f962f0cf6c9",
              "gas": "0x5d111",
              "gasUsed": "0xc8d",
              "to": "0xe7f1725e7734ce288f8367e1bb143e90bb3f0512",
              "input": "0xbf40fac10000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000001a4f564d5f4c3143726f7373446f6d61696e4d657373656e676572000000000000",
              "output": "0x000000000000000000000000610178da211fef7d417bc0e6fed39f05609ad788",
              "type": "STATICCALL"
            },
            {
              "from": "0xdc64a140aa3e981100a9beca4e685f962f0cf6c9",
              "gas": "0x5b909",
              "gasUsed": "0x2d19f",
              "to": "0x610178da211fef7d417bc0e6fed39f05609ad788",
              "input": "0xd764ad0b000100000000000000000000000000000000000000000000000000000000000000000000000000000000000042000000000000000000000000000000000000100000000000000000000000009fe46736679d2d9a65f0992f2272de9f3c7fa6e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000000000000000000000000000000000000000000000000000000000000000e40166a07a000000000000000000000000e6e340d132b5f46d1e472debcd681b2abc16e57e0000000000000000000000007c6b91d9be155a6db01f749217d76ff02a7227f2000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb92266000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb922660000000000000000000000000000000000000000000000000de0b6b3a764000000000000000000000000000000000000000000000000000000000000000000c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
              "calls": [
                {
                  "from": "0xdc64a140aa3e981100a9beca4e685f962f0cf6c9",
                  "gas": "0x54236",
                  "gasUsed": "0x354",
                  "to": "0x5fc8d32690cc91d4c39d9d3abcbd16989f875707",
                  "input": "0x9bf62d82",
                  "output": "0x0000000000000000000000004200000000000000000000000000000000000007",
                  "calls": [
                    {
                      "from": "0x5fc8d32690cc91d4c39d9d3abcbd16989f875707",
                      "gas": "0x52b78",
                      "gasUsed": "0x171",
                      "to": "0x0dcd1bf9a1b36ce34237eeafef220932846bcd82",
                      "input": "0x9bf62d82",
                      "output": "0x0000000000000000000000004200000000000000000000000000000000000007",
                      "value": "0x0",
                      "type": "DELEGATECALL"
                    }
                  ],
                  "type": "STATICCALL"
                },
                {
                  "from": "0xdc64a140aa3e981100a9beca4e685f962f0cf6c9",
                  "gas": "0x50df0",
                  "gasUsed": "0x1e56d",
                  "to": "0x9fe46736679d2d9a65f0992f2272de9f3c7fa6e0",
                  "input": "0x0166a07a000000000000000000000000e6e340d132b5f46d1e472debcd681b2abc16e57e0000000000000000000000007c6b91d9be155a6db01f749217d76ff02a7227f2000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb92266000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb922660000000000000000000000000000000000000000000000000de0b6b3a764000000000000000000000000000000000000000000000000000000000000000000c00000000000000000000000000000000000000000000000000000000000000000",
                  "calls": [
                    {
                      "from": "0x9fe46736679d2d9a65f0992f2272de9f3c7fa6e0",
                      "gas": "0x4e57f",
                      "gasUsed": "0x92b",
                      "to": "0x5fbdb2315678afecb367f032d93f642f64180aa3",
                      "input": "0xb7947262",
                      "output": "0x0000000000000000000000000000000000000000000000000000000000000000",
                      "type": "STATICCALL"
                    },
                    {
                      "from": "0x9fe46736679d2d9a65f0992f2272de9f3c7fa6e0",
                      "gas": "0x4c8cb",
                      "gasUsed": "0x1b395", // <--- HERE
                      "to": "0xb7f8bc63bbcad18155201308c8f3540b07f84f5e",
                      "input": "0x0166a07a000000000000000000000000e6e340d132b5f46d1e472debcd681b2abc16e57e0000000000000000000000007c6b91d9be155a6db01f749217d76ff02a7227f2000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb92266000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb922660000000000000000000000000000000000000000000000000de0b6b3a764000000000000000000000000000000000000000000000000000000000000000000c00000000000000000000000000000000000000000000000000000000000000000",
                      "calls": [
                        {
                          "from": "0x9fe46736679d2d9a65f0992f2272de9f3c7fa6e0",
                          "gas": "0x4b1b5",
                          "gasUsed": "0xc75",
                          "to": "0xdc64a140aa3e981100a9beca4e685f962f0cf6c9",
                          "input": "0x6e296e45",
                          "output": "0x0000000000000000000000004200000000000000000000000000000000000010",
                          "calls": [
                            {
                              "from": "0xdc64a140aa3e981100a9beca4e685f962f0cf6c9",
                              "gas": "0x49bd4",
                              "gasUsed": "0x4bd",
                              "to": "0xe7f1725e7734ce288f8367e1bb143e90bb3f0512",
                              "input": "0xbf40fac10000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000001a4f564d5f4c3143726f7373446f6d61696e4d657373656e676572000000000000",
                              "output": "0x000000000000000000000000610178da211fef7d417bc0e6fed39f05609ad788",
                              "type": "STATICCALL"
                            },
                            {
                              "from": "0xdc64a140aa3e981100a9beca4e685f962f0cf6c9",
                              "gas": "0x49570",
                              "gasUsed": "0x224",
                              "to": "0x610178da211fef7d417bc0e6fed39f05609ad788",
                              "input": "0x6e296e45",
                              "output": "0x0000000000000000000000004200000000000000000000000000000000000010",
                              "value": "0x0",
                              "type": "DELEGATECALL"
                            }
                          ],
                          "type": "STATICCALL"
                        },
                        {
                          "from": "0x9fe46736679d2d9a65f0992f2272de9f3c7fa6e0",
                          "gas": "0x7530",
                          "gasUsed": "0x7530",
                          "to": "0xe6e340d132b5f46d1e472debcd681b2abc16e57e",
                          "input": "0x01ffc9a701ffc9a700000000000000000000000000000000000000000000000000000000",
                          "error": "write protection",
                          "type": "STATICCALL"
                        },
                        {
                          "from": "0x9fe46736679d2d9a65f0992f2272de9f3c7fa6e0",
                          "gas": "0x7530",
                          "gasUsed": "0x7530",
                          "to": "0xe6e340d132b5f46d1e472debcd681b2abc16e57e",
                          "input": "0x01ffc9a701ffc9a700000000000000000000000000000000000000000000000000000000",
                          "error": "write protection",
                          "type": "STATICCALL"
                        },
                        {
                          "from": "0x9fe46736679d2d9a65f0992f2272de9f3c7fa6e0",
                          "gas": "0x39714",
                          "gasUsed": "0x7405",
                          "to": "0xe6e340d132b5f46d1e472debcd681b2abc16e57e",
                          "input": "0xa9059cbb000000000000000000000000f39fd6e51aad88f6f4ce6ab8827279cfffb922660000000000000000000000000000000000000000000000000de0b6b3a7640000",
                          "output": "0x0000000000000000000000000000000000000000000000000000000000000001",
                          "value": "0x0",
                          "type": "CALL"
                        }
                      ],
                      "value": "0x0",
                      "type": "DELEGATECALL"
                    }
                  ],
                  "value": "0x0",
                  "type": "CALL"
                }
              ],
              "value": "0x0",
              "type": "DELEGATECALL"
            }
          ],
          "value": "0x0",
          "type": "CALL"
        }
      ],
      "value": "0x0",
      "type": "DELEGATECALL"
    }
  ],
  "value": "0x0",
  "type": "CALL"
}

@maurelian maurelian added the Disagree With Severity The sponsor disputed the severity of this issue label Apr 18, 2023
@GalloDaSballo
Copy link
Collaborator

Would suggest checking for known withdrawals and seeing if this can be a concern (and raising to High in that case)

The conditionality leads me to agree with Med

@GalloDaSballo GalloDaSballo added Medium A valid Medium severity issue and removed High A valid High severity issue Disagree With Severity The sponsor disputed the severity of this issue labels Apr 18, 2023
@GalloDaSballo
Copy link
Collaborator

GalloDaSballo commented Apr 21, 2023 •
edited
Loading

Sample list of withdrawals
https://gist.github.com/GalloDaSballo/66d73fb9d2f5fdf904349406ceb5ebfb

Annotated Gas Consumption of integrations
https://gist.github.com/GalloDaSballo/9dd42b901528f31fe8db244cfb1ef514
https://gist.github.com/GalloDaSballo/f27d5a6cf7bd0ec7dd03b5de7d3bcdaf

I believe there are some cases in which the above txs, which have corresponding events, will require more than 135k gas meaning they are subject to the attack

@GalloDaSballo GalloDaSballo added High A valid High severity issue and removed Medium A valid Medium severity issue labels Apr 21, 2023
@GalloDaSballo
Copy link
Collaborator

GalloDaSballo commented Apr 21, 2023 •
edited
Loading

I think this is a valid example:
https://explorer.phalcon.xyz/tx/eth/0x610d1ca15b934970949f138a6e11847179ada6adff867621d03d220962aa5fc9?line=14

relayMessage -> does something -> send a message back

Contract: https://etherscan.io/address/0xcEA770441aa5eFCD3f5501b796185Ec3055A76D7/advanced#internaltx

@sherlock-admin sherlock-admin added the Reward A payout will be made for this issue label Apr 23, 2023
@koolexcrypto
Copy link

Escalate for 10 USDC.

While the issue is creatively accurate with the specified gas values, it still requires certain conditions to be feasbile (e.g. only withdrarwals require more than 135,175 gas).

According to Sherlock's Criteria, it is a valid medium.

Causes a loss of funds but requires certain external conditions or specific states

Lastly, all the respect to the good efforts put in behind this finding.

@sherlock-admin
Copy link
Contributor Author

Escalate for 10 USDC.

While the issue is creatively accurate with the specified gas values, it still requires certain conditions to be feasbile (e.g. only withdrarwals require more than 135,175 gas).

According to Sherlock's Criteria, it is a valid medium.

Causes a loss of funds but requires certain external conditions or specific states

Lastly, all the respect to the good efforts put in behind this finding.

You've created a valid escalation for 10 USDC!

To remove the escalation from consideration: Delete your comment.

You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.

@sherlock-admin sherlock-admin added the Escalated This issue contains a pending escalation label Apr 25, 2023
@ArnieSec ArnieSec mentioned this issue Apr 25, 2023
Closed
@hrishibhat
Copy link
Contributor

Escalation rejected

Lead Judge comment:

Maintain High Severity because while the condition is necessary it is not up to the user to decide whether that requirement was met but rather the requirement is imposed by the script

This is a valid flaw in the system due to an incorrect assumption.

@sherlock-admin
Copy link
Contributor Author

Escalation rejected

Lead Judge comment:

Maintain High Severity because while the condition is necessary it is not up to the user to decide whether that requirement was met but rather the requirement is imposed by the script

This is a valid flaw in the system due to an incorrect assumption.

This issue's escalations have been rejected!

Watsons who escalated this issue will have their escalation amount deducted from their next payout.

@sherlock-admin sherlock-admin added Escalation Resolved This issue's escalations have been approved/rejected and removed Escalated This issue contains a pending escalation labels May 19, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
Escalation Resolved This issue's escalations have been approved/rejected High A valid High severity issue Reward A payout will be made for this issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@GalloDaSballo @hrishibhat @maurelian @sherlock-admin @koolexcrypto