Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: high

Replay Attack using another chain with same salt

alra

Summary

Malicious user can Replay Calldata on Different Chains Causing Double-Spend Issue on 'deployProxyAndDistributeBySignature', due to lack of no dynamic variable as block.timestamp or chain.id on digest formation, deploying the proxy and distributing to anterior addresses.
The protocol has declared its intentions to be deployed to any EVM-compatible chains, so this is probable to happen.

Vulnerability Details

Due to lack of dynamic variables as block.timestamp or chain.id on digest formation someone can replicate the same digest and signature on ProxyFactory::deployProxyAndDistributeBySignature if the salt, which is formed by organizer, contestId and implementation of the contest is the same in another EVM chain.

Impact

Loss or steal of 95% of funds in contest.

Tools Used

Manual review, Foundry.

Recommendations

Implement a block.timestamp or a chain.id on digest formation.

function _calculateSalt(address organizer, bytes32 contestId, address implementation)
internal
pure
returns (bytes32)
{
- return keccak256(abi.encode(organizer, contestId, implementation));
+ return keccak256(abi.encode(organizer, contestId, implementation, chain.id));
}

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.