First Flight #12: Kitty Connect

Summary

The KittyBridge::_ccipReceive function is triggered upon the receipt of each new incoming message from the CCIP protocol router. According to best practices, it is recommended to verify the sender of the CCIP message, whose value is stored as the property sender of Client.Any2EVMMessage structure. However, in the KittyBridge::_ccipReceive function, verification is attempted using msg.sender, which will always equal the CCIP router address.

Vulnerability Details

• The KittyBridge::_ccipReceive function utilizes the onlyAllowlisted modifier to authenticate the sender of the CCIP message with the source chain selector.

• This function employs msg.sender for sender verification, where msg.sender will always be the router. This is guaranteed by the onlyRouter modifier from the CCIPReceiver smart contract.

• It is expected that this function should authenticate the actual sender from the source chain.

Impact

• The verification of the CCIP message sender is incorrect, and without adding the router address to the allowlistedSenders, this method will consistently fail, regardless of who sends the message.

• Consequently, in most cases, KittyBridge::_ccipReceive will fail due to incorrect sender validation.

Tools Used

Manual review and CCIP documentation.

Recommendations

The above changes rectify the issue by ensuring that KittyBridge::_ccipReceive correctly authenticates the sender of the CCIP message, thus addressing the identified vulnerability.