stake.link

Summary

contracts/core/ccip/base/SDLPoolCCIPController.sol#56-59
contracts/core/ccip/RESDLTokenBridge.sol#71-74
contracts/core/ccip/SDLPoolCCIPControllerPrimary.sol#48-51
contracts/core/ccip/SDLPoolCCIPControllerSecondary.sol#119-140

The onlyBridge modifier is likely used to restrict who can call certain functions of the contract, allowing only the reSDLTokenBridge to execute specific actions. For example, in the ccipSend function, this access modifier is used. In the case where this access modifier has reSDLTokenBridge set to address(0), calling the ccipSend function would never execute because the msg.sender calling the function will never be address(0), and the ccipSend function would never be able to execute. This would result in an inability to send messages or tokens between blockchains, rendering the contract obsolete, as the main function of the protocol is cross-chain communication."

Vulnerability Details

"The access modifier onlyBridge() in the SDLPoolCCIPController.sol contract establishes that if msg.sender != reSDLTokenBridge, the operation should be reverted. However, the issue is that at no point is it checked whether the variable reSDLTokenBridge has a value other than address(0). In the setRESDLTokenBridge function, where a value is assigned to the reSDLTokenBridge variable, there is no check to ensure that the set value is different from address(0). This results in a potential flaw in case the value of the reSDLTokenBridge variable is set to address(0)."

Impact

If the variable reSDLTokenBridge is assigned a value of address(0), the contract would become obsolete because the functions using the onlyBridge modifier could not be called. This is because the modifier would always revert the function call.

Tools Used

Audit Wizard, Slither, Chat GPT, Manual Review

Recommendations

The state variables used in access modifiers must undergo an additional check to prevent undesired behaviors or failures in a smart contract. In this case, the failure can be avoided by performing an extra check in the setRESDLTokenBridge function, for example:

function setRESDLTokenBridge(address _reSDLTokenBridge) external onlyOwner {
    require(_reSDLTokenBridge != address(0), "address(0) is not permit");
    reSDLTokenBridge = _reSDLTokenBridge;
}