MorpheusAI

Note: I have submitted total four reports of similar kind of this report. Although their issues are of same type but their root cause were different and fixing one will not fix another. So I treated them as 4 separate issues with their recommended mitigation

Vulnerability Details :

L2MessageReceiverV2 contract inheriting UUPSUpgradeable so overriding _authorizeUpgrade() function. But adding no access control to this function can lead to setting implementation contract by anyone since this function is called for authorization. By setting any malicious contract as implementation attacker can selfdestruct() the proxy contract. Since implementation is called using delegatecall from proxy.

Code Snippet :

contracts/mock/L2MessageReceiverV2.sol

Since L2MessageReceiverV2 contract is inheriting UUPSUpgradeable from openzeppelin. We can see when upgrading implementation address using upgradeToAndCall then _authorizeUpgrade() is called.

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/proxy/utils/UUPSUpgradeable.sol#L86C5-L90C1

Malicious L2MessageReceiverV2 implementation contract

First attacker will call upgradeToAndCall to main proxy contract which will change the implementation contract address to his malicious L2MessageReceiverV2 contract.
Now Attacker will call destroyMe to main proxy contract of L2MessageReceiverV2 and by delegatecall proxy will call implementation contract .It will destroy the main proxy contract using selfdestruct().

Impact :

The main proxy contract will be destroyed.

Tools Used

Manual Review

Recommended Mitigation Steps :

Add proper access control to _authorizeUpgrade() function since it is used for authorization at the time of changing implementation contract address. This can be mitigated by using 'OwnableUpgradeable' of openzeppelin and add onlyOwner modifier to the _authorizeUpgrade() function so. Only owner can be authorized to upgrade the implementation address. Add one initializer function also to initialize the owner.