Zaros Part 1
Zaros
DeFiFoundry
60,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Cross-Chain Signature Replay Attack

0xabhayy

Summary

The structHash calculation in the fillOffchainOrders Function is missing the chain ID, exposing the protocol to cross-chain replay attacks. Given Zaros Protocol's plan to launch on both Arbitrum and Monad chains, this vulnerability is critical.

Vulnerability Details

The vulnerability is in the SettlementBranch contract, specifically within the fillOffchainOrders function. The relevant code snippet is:

ctx.structHash = keccak256(
abi.encode(
Constants.CREATE_OFFCHAIN_ORDER_TYPEHASH,
ctx.offchainOrder.tradingAccountId,
ctx.offchainOrder.marketId,
ctx.offchainOrder.sizeDelta,
ctx.offchainOrder.targetPrice,
ctx.offchainOrder.shouldIncreaseNonce,
ctx.offchainOrder.nonce,
ctx.offchainOrder.salt
//@audit missing chainID
)
);

The structHash calculation is missing the chain ID (block.chainid). This omission makes the contract vulnerable to cross-chain replay attacks. A replay attack occurs when a valid transaction executed on one blockchain is maliciously or fraudulently repeated on another blockchain.

Impact

Severity: Medium

Potential Consequences:
Unauthorized transactions on different chains.
Loss of funds and integrity of the protocol.

Tools Used

Manual Review

Recommendations

Include Chain ID in structHash:

ctx.structHash = keccak256(
abi.encode(
Constants.CREATE_OFFCHAIN_ORDER_TYPEHASH,
ctx.offchainOrder.tradingAccountId,
ctx.offchainOrder.marketId,
ctx.offchainOrder.sizeDelta,
ctx.offchainOrder.targetPrice,
ctx.offchainOrder.shouldIncreaseNonce,
ctx.offchainOrder.nonce,
ctx.offchainOrder.salt
++ block.chainid
)
);
Updates

Lead Judging Commences

inallhonesty Lead Judge
11 months ago
inallhonesty Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Appeal created

0xabhayy Submitter
10 months ago
inallhonesty Lead Judge
10 months ago
0xabhayy Submitter
10 months ago
inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.