Project

Summary

The callExternalContract function allows any address with the EXTERNAL_CALLER role to make arbitrary calls to external contracts with no restrictions. This can be exploited if an attacker gains access to the EXTERNAL_CALLER role, enabling them to interact with any external contract using arbitrary data. Additionally, the role can be misused to alter the state of this contract or other vulnerable contracts it interacts with

Exploit Scenario

1. Compromised EXTERNAL_CALLER: Assume an attacker compromises an account with the EXTERNAL_CALLER role. They could now use callExternalContract to interact with any contract of their choosing. For example, they could:

2. • Call a malicious contract that appears harmless but actually reverts in a way that disrupts contract functionality.

   • Interact with a financial contract to manipulate asset states or drain funds if improperly secured.

3. Unintended Access to Sensitive Contracts: The caller could unintentionally call sensitive functions in trusted contracts, resulting in unintended state changes or loss of funds.

Impact

If compromised, the EXTERNAL_CALLER role could be leveraged to drain funds, interact with unintended contracts, or otherwise misuse the factory’s permissions for malicious purposes.

Tools Used

Manual Review

Recommendations

Restrict callExternalContract to an allowlist of safe addresses or specific contracts the factory is meant to interact with. Alternatively, make this function callable only by the DEFAULT_ADMIN_ROLE and carefully manage role assignment.