MorpheusAI
MorpheusAI
Foundry
22,500 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Re-Entrancy Vulnerability Due to Delayed State Update in retryMessage Function

llill

Summary

The retryMessage function in the L2MessageReceiver contract is susceptible to a re-entrancy attack. The function first executes business logic (_nonblockingLzReceive) before updating the contract's state (delete failedMessages[...]). This order of operations could potentially allow an attacker to re-enter the function before the state is updated.

Vulnerability Details

function retryMessage(
uint16 senderChainId_,
bytes memory senderAndReceiverAddresses_,
uint64 nonce_,
bytes memory payload_
) external {
bytes32 payloadHash_ = failedMessages[senderChainId_][senderAndReceiverAddresses_][nonce_];
require(payloadHash_ != bytes32(0), "L2MR: no stored message");
require(keccak256(payload_) == payloadHash_, "L2MR: invalid payload");
​
_nonblockingLzReceive(senderChainId_, senderAndReceiverAddresses_, payload_);
​
delete failedMessages[senderChainId_][senderAndReceiverAddresses_][nonce_];
​
emit RetryMessageSuccess(senderChainId_, senderAndReceiverAddresses_, nonce_, payload_);
}

And then _nonblockingLzReceive will mint MOR tokens to user
Ideally, the deletion should occur before calling _nonblockingLzReceive to prevent potential re-entrancy.

Impact

If exploited, an attacker could repeatedly call retryMessage for the same nonce_, potentially leading to unexpected behavior such as duplicate token minting. This poses a significant security risk, potentially leading to financial losses or integrity issues in the token distribution mechanism.
Probability : Low
Impact : High

Tools Used

VsCode

Recommendations

Implement a CEI pattern for this function :

delete failedMessages[senderChainId_][senderAndReceiverAddresses_][nonce_];
_nonblockingLzReceive(senderChainId_, senderAndReceiverAddresses_, payload_);
Updates

Lead Judging Commences

inallhonesty Lead Judge
almost 2 years ago
inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.