Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(protocol): remove repetitive words in audit report #18584

Merged
merged 1 commit into from
Dec 15, 2024
Merged

chore(protocol): remove repetitive words in audit report #18584

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions packages/protocol/audit/code4rena-2024-03-taiko-final-report.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -670,7 +670,7 @@ Notice how if the payment is in ERC20 tokens, the payee will be the variable \_m

1. proposer A approves the assignmentHook contract to spend a portion of their tokens, the allowance is set higher than the actual fee they will be paying.
2. proposer A proposes a block, and a fee is charged and payed to the assigned prover, but there remains allowance that the assignment hook contract can still use.
3. proposer B proposes a block and sets params.coinbase as the the address of proposer A.
3. proposer B proposes a block and sets params.coinbase as the address of proposer A.
4. proposer A address will be the payee of the fee for the assigned prover for the block proposed by proposer B.

The scenario above describes how someone can be forced maliciously to pay fees for block proposals by other actors.
Expand Down Expand Up @@ -1207,7 +1207,7 @@ When this function is called to un-suspend a message we set `proofReceipt[msgHas

`bridge_watchdog` can therefore forge arbitrary messages and have them treated as proven by first suspending them and then un-suspending them.

`bride_watchdog` is supposed to only be able to ban and suspend messages, in the expected worst case `bridge_watchdog` is limited to DDOSing messages and bans until governance removes the the `bridge_watchdog`.
`bride_watchdog` is supposed to only be able to ban and suspend messages, in the expected worst case `bridge_watchdog` is limited to DDOSing messages and bans until governance removes the `bridge_watchdog`.

With the privilege escalation shown here the role can instead drain the bridge of all ETH and tokens.

Expand Down
Loading