Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-4] Unprotected Branch Upgrades in `RootProxy` Enable Total Protocol Takeover

0xsnoweth

Summary

The RootProxy contract delegates calls to branch contracts but lacks access control on upgrades. An attacker with upgrade privileges can replace critical logic to drain funds or disrupt operations.

Vulnerability Details

Affected Code:

constructor(InitParams memory initRootUpgrade) {
RootUpgrade.Data storage rootUpgrade = RootUpgrade.load();
rootUpgrade.upgrade(...); // Initial setup
}

If RootUpgrade allows post-deployment upgrades (not shown but implied by upgrade function), unauthorized changes to branch implementations are possible.

Impact

Exploit Scenario:

  1. Attacker gains upgrade rights (e.g., compromised admin key).

  2. Replaces transfer selector with malicious branch.

  3. Drains all funds via hijacked logic.

Tools Used

Manual code analysis

Recommendations

  1. Implement role-based access control:

modifier onlyGovernance() {
require(msg.sender == governanceAddress, "Unauthorized");
_;
}

2.. Use timelocks for upgrades.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.