Submitted by 0x007
If a chain is compromised, it can not transfer beyond its balance. However, theres a clever way to increase its balance arbitrarily.
A compromised chain can deploy token manager to a token controlled by the attacker on a different chain (or in the future, deploy ITS with their minter address). The balance on that chain would be untracked and the attacker can bridge an unlimited amount to the compromised chain to increase its balance. This is very severe because the main purpose of the hub and audit is to reduce damage to the wider ecosystem when a chain is compromised.
So the goal is to create an untracked balance that we can bridge from. We dont want Ethereum, cause we would have to buy and own the real tokens. So instead:
In fact, transferring to WoofChain to increase the tracked balance is unnecessary. We could have bridged from BNB to the original chain Ethereum if theres an ITS connection between them. According to the Publicly Known Issues section of README, the hub would be updated to not track balance when a minter is specified. This would enable the bug in a different function because the attacker could specify their address as the minter.
Examples of a compromise that could happen include:
Token hub should store the original chain of each ITS tokenId and allow token or manager deployment from the original chain only. This would limit the access of remote chains to transfers.
Access Control
milapsheth (Axelar) confirmed and commented:
0xsomeone (judge) commented:
milapsheth (Axelar) commented:
0xsomeone (judge) decreased severity to Medium and commented:
For this audit, 25 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by Bauchibred received the top score from the judge.
The following wardens also submitted reports: Sparrow, ZanyBonzy, Agontuk, K42, kirill_taran, MrPotatoMagic, bronze_pickaxe, trachev, solosync6, debo, Sisi, PolarizedLight, 0xStalin, jasonxiale, hunter_w3b, Trooper, mxuse, ayden, fibonacci, Bob, gjaldon, klau5, KupiaSec, and WenResults.
