Submitted by MrPotatoMagic
Bridge agents are removed/toggled off to stop communication to/from them (confirmed by sponsor); in case of some situation, such as a bug in protocol or in case of an upgrade to a newer version of the protocol (in case LayerZero decides to upgrade/migrate their messaging library).
Admin router contracts are able to disable or toggle off anybodys bridge agents due to any reasons through the removeBranchBridgeAgent() function in CoreRootRouter.sol contract. But although this toggles off the branch bridge agent in the Branch chains BranchPort, it still allows No Deposit calls to originate from that deactivated branch bridge agent.
Here is the whole process:
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/CoreRootRouter.sol#L186
Note: Over here there is no call made back to the root chain again, which means the synced branch bridge agent is still synced in root (as shown here). But even if it is synced in Root chain, there are no checks or even state variables to track activeness (bool isActive) of branch bridge agent on the Root chain end as well. Not related to this POC but good to be aware of.
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/BranchBridgeAgent.sol#L195
There are few important points to note here:
The issues here to solve are:
Solution for callOut() function:
Check added on Line 202 - same can be applied for callOutSigned()):
Solution for point 2:
In users branch bridge agent, the following check should be added in Func ID 0x00 No deposit if block in the lzReceiveNonBlockingFunction.
Check added on Line 602:
In case of the Maia administration contracts, the calls from the root chain CoreRootRouterAddress-CoreRootBridgeagent pair should not be stopped. Therefore, in the administrations corresponding CoreBranchBridgeAgent contract, do not add the above check in order to allow no deposit calls to go through.
This way when the branch bridge agent is inactive, only the Maia Administration CoreRootRouter can continue execution.
Error
0xBugsy (Maia) confirmed, but disagreed with severity and commented:
alcueca (judge) decreased severity to Medium and commented:
0xBugsy (Maia) commented:
