Submitted by horsefacts, also found by ayeslick, cccz, peritoflores, teddav, and vlad_bochok
https://github.com/code-423n4/2022-08-mimo/blob/eb1a5016b69f72bc1e4fd3600a65e908bd228f13/contracts/proxy/MIMOProxy.sol#L21-L24
https://github.com/code-423n4/2022-08-mimo/blob/eb1a5016b69f72bc1e4fd3600a65e908bd228f13/contracts/proxy/MIMOProxy.sol#L55-L64
The MIMOProxy contract stores per-caller, per-target, per-selector permissions in a nested internal mapping.
MIMOProxy.sol#L21:
If the caller of execute is an authorized envoy with the right permissions, they are allowed to delegatecall from the MIMOProxy instance.
MIMOProxy.sol#L55:
However, although these permissions are stored in an internal mapping, a malicious (or malfunctioning) target contract with the same or overlapping storage layout may manipulate envoy permissions. Malicious target contracts may use this method to grant themselves additional permissions or authorize other envoys and targets.
Note that MIMOProxy defends against similar attempts to change the contract owner by storing the current owner address before executing delegatecall and checking that it has not changed after. However, due to the nature of Solidity mappings, and the nestedness of the permissions mapping, its not feasible to perform the same check for envoy permissions.
An authorized envoy + malicious target may intentionally modify or accidentally overwrite envoy permissions. Malicious target contracts may attempt to trick users into escalating privileges using this method.
This is a tough one, but if the addresses of Mimo-authorized target contracts are known, consider maintaining and consulting an external registry to further constrain envoys and prevent them from calling target contracts that are not known Mimo modules:
Well use this ProxyAttacks helper contract to manipulate proxy storage. Note that it has the same storage layout as MIMOProxy.
Then deploy the ProxyAttacks helper in a test environment and use MIMOProxy to delegatecall into it:
RayXpub (Mimo) acknowledged and commented:
gzeoneth (judge) commented:
horsefacts (warden) reviewed mitigation:
