First Flight #12: Kitty Connect

Summary

• onlyAllowlisted modifier is checking msg.sender as sender. but, the actual sender is abi.decode(any2EvmMessage.sender, (address)). so, it can be bypassed by sending the transaction from the allowlisted address.

Vulnerability Details

• _ccipReceive function have onlyAllowlisted modifier with wrong sender address. The actual sender is abi.decode(any2EvmMessage.sender, (address)) but the modifier is checking msg.sender.

POC

• here is the poc to bypass the onlyAllowlisted modifier.

  • abi.decode(any2EvmMessage.sender, (address)) is actual sender.

  • msg.sender is not sender

  • if msg.sender is allowlistedSenders then it will bypass the check all the time because msg.sender is not change in every tranction but the actual sender(i.e abi.decode(any2EvmMessage.sender, (address))) is change in every transaction if it done by different address.

Impact

• this bypass the check for allowlistedSenders[_sender] is true or not because the sender is not the msg.sender. but, the actual sender is abi.decode(any2EvmMessage.sender, (address)).

Tools Used

• Manual review

Recommendations

• Here is the updated code