stake.link

Summary

The SDLPoolCCIPController.sol::recoverTokens function does not correctly handle the retrieval of tokens for users that mistakenly send token to the SDLPoolCCIPController.sol contract which would inevitably cause loss of token in a scenario where more than one user mistakenly send token to the contract.

Vulnerability Details

The fact that the SDLPoolCCIPController.sol::recoverTokens function doesn't have any check in place to determine how much token was actually mistakenly sent by a user claiming to get a retrieval actually leads to a vulnerability where when there is more than one user that actually mistakenly send the same token to the contract, the first user to reach out to the team for token retrieval would get all of the token balance on the contract and not what they mistakenly sent leading to loss of token for the remaining users.

Impact

There would be loss of token to every user that mistakenly send the same type of token to the contract except for the first person that reach out to the project for retrieval

Note: SDLPoolCCIPController.sol is a base contract for both SDLPoolCCIPPrimaryController.sol and SDLPoolCCIPSecondaryController.sol so we would be using the SDLPoolCCIPPrimaryController.sol for our test case

Below is a step by step guide to test and confirm the vulnerability
Open the sdl-pool-ccip-primary-controller.test.ts file and paste the below code in the beforeEach block of the test code

Then paste the below test inside of the describe block of the test code

Then run the below code in your terminal

On running the code above you should get the below output that shows that indeed the vulnerability was exploited

Tools Used

Hardhat Test Suite

Recommendations

I know well enough it can really be some extra works to always check how much is mistakenly sent by any user who mistakenly send this contract some token but if the protocol would prefer to keep this functionality then they would really need to have some eventListener that would always listen to an event that is emitted whenever the SDLPoolCCIPController.sol receive token and the event details can be used to map the sent amount to each user that mistakenly send the token and then whenever a user wants to retrieve their token this mapping can be use to get the amount sent by them and send them back just that amount instead of all the balance of the contract on the mistakenly sent token.