stake.link

Summary

Lack of thorough sender validation in the CCIP message handling logic. This presents a risk of unauthorized accounts submitting fake cross-chain messages to manipulate contract state.

Vulnerability Details

The functions that process CCIP messages are: SDLPoolCCIPController.ccipReceive
SDLPoolCCIPController._verifyCCIPSender

However, _verifyCCIPSender() only checks: SDLPoolCCIPControllerPrimary.Line 376

It compares the sender to a whitelist based on the source chain. But there are no checks that:

• The source chain ID itself is valid

• The sender is an authorized CCIP router on that chain

This leaves open the possibility for an attacker to:

1. Specify any fake source chain ID

2. Set themselves as the sender

3. Bypass the whitelist check since the chain is made up

4. Submit arbitrary state-changing messages to the pool

Impact

To exploit this, an attacker could:

• Drain funds by sending fake transfer messages

• Manipulate balances by sending fake deposit/withdrawal notifications

• Disrupt operations by sending conflicting or reversing messages

Tools Used

Vs

Recommendations

More robust sender validation is needed in _verifyCCIPSender():

This would prevent fake or unauthorized messages from being accepted.