Submitted by pcrypt0, also found by 0x1337, AmitN, csanuragjain, danb, dirky, GermanKuber, IllIllI, kirk-baird, and WatchPug
Gravity.sol#L632-L638
Gravity.sol#L595-L609
Ability for admin to drain all ERC20 funds stored in contract at will, meaning all ERC20 based Cudos tokens (and any other ERC20 tokens stored in the contract) could be extracted by anyone with admin role and later sold, leaving users funds bridged on Cudos Cosmos chain with no ERC20 representation stored across the bridge - similar in impact as the wormhole hack.
This issue ought to fall within the limits the team allocated on assessing the governance role setups, since it describes a full-fledged security risk regarding users funds. Crucially, this function is not in the original Gravity Bridge contract for Gravity.sol.
Furthermore, the function has not been commented and does not appear in the documentation, suggesting that it has perhaps not yet been reasoned through by the development team and its critical this is flagged in the security audit.
Firstly, User with admin role granted waits until CUDOS bridge has decent TVL from users bridging their CUDOS tokens from Ethereum to the CUDOS Cosmos chain,
Secondly, User manually calls withdrawERC20(address _tokenAddress) with the ERC token address of the CUDOS token
Thirdly, withdrawERC20() function checks if user has admin role and if so withdraws all the tokens of a given token address straight to the admins personal wallet
Fourth, user exchanges CUDOS on DEX and then sends funds to tornado cash, leaving all user funds at risk.
My own logical reasoning and discussion with team on Discord for confirmation of admin roles and functions logic.
Delete the function or alternatively, send all funds to the 0 address to burn rather than give them to the admin.
Change withdrawERC20 to:
maptuhec (Cudos) acknowledged and commented:
Albert Chon (judge) decreased severity to Medium
