MorpheusAI

Summary

Contracts L1SenderV2.sol, L2MessageReceiver.sol, L2TokenReceiverV2.sol, DistributionV2.sol do not implement onlyOwner on _authorizeUpgrade.

Contracts which use UUPSUpgradeable should always override the _authorizeUpgrade function and add access control modifier such as onlyOwner.

Vulnerability Details

The _authorizeUpgrade function is required to be over-ridden and assigned an access modifier such as onlyOnwer so no unauthorized user can pass in their own address for a malicious implementation of a contract.

openzeppelin docs provide clear instructions on how to implement UUPSUpgradeable here
https://docs.openzeppelin.com/contracts/4.x/api/proxy#UUPSUpgradeable-_authorizeUpgrade-address-

Impact

Failure to provide the onlyOwner access modifier on _authorizeUpgrade functions allow any one to call the function and assign any malicious implementation of the contract.

Tools Used

Manual Review

Recommendations

Consider following the docs provided by OpenZeppelin and add access control modifier such as onlyOwner on all instances of _authorizeUpgrade.