Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

[H-5] Unprotected Branch Upgrades Enable Total Protocol Takeover

0xsnoweth

Summary

The RootProxy contract delegates calls to branch contracts but lacks access control on post-deployment upgrades. Attackers can replace critical logic to drain funds or brick the protocol.

Vulnerability Details

Affected Code:

// RootProxy.sol - Constructor
constructor(InitParams memory initRootUpgrade) {
RootUpgrade.Data storage rootUpgrade = RootUpgrade.load();
rootUpgrade.upgrade(...); // Initial setup
}
​
// RootUpgrade.sol (implied) - Hypothetical upgrade function
function upgrade(BranchUpgrade[] memory branches) public {
// No access control checks
}

If RootUpgrade allows post-deployment upgrades (not shown but implied by upgrade function), unauthorized changes to branch implementations are possible.

Exploit Scenario:

Attacker gains temporary admin access (phishing/compromised key).

Calls RootUpgrade.upgrade() to replace the transfer branch with malicious logic.

Drains all funds via transfer(address attacker, totalAssets()).

Impact

Exploit Scenario:

Theft of All Funds: High likelihood via logic override.

Protocol Shutdown: Attacker can deploy broken implementations.

Tools Used

Manual code analysis

Foundry

Recommendations

  1. Implement role-based access control:

​
modifier onlyGovernance() {
require(msg.sender == governanceAddress, "Unauthorized");
_;
}

  1. Use OpenZeppelin’s TimelockController for delay enforcement.

Updates

Lead Judging Commences

inallhonesty Lead Judge 3 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.