Malicious/compromised owner can lead to limitless minting of gov NFT

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/GovNFT.sol#L240

Vulnerability details

Impact

Malicious/compromised owner can lead to limitless minting of gov NFT.

Proof of Concept

A malicious or compromised governor can set the endpoint address to any malicious address.

function setEndpoint(ILayerZeroEndpoint _endpoint) external onlyOwner {
        require(address(_endpoint) != address(0), "ZeroAddress");
        endpoint = _endpoint;
    }

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/GovNFT.sol#L240

The malicious endpoint can mint NFT to his own address without any limitation by calling the function lzReceive.

function lzReceive(
        uint16 _srcChainId,
        bytes memory _srcAddress,
        uint64 _nonce,
        bytes memory _payload
    ) external override {
        require(_msgSender() == address(endpoint), "!Endpoint");
        (bool success, bytes memory reason) = address(this).excessivelySafeCall(gasleft()*4/5, 150, abi.encodeWithSelector(this.nonblockingLzReceive.selector, _srcChainId, _srcAddress, _nonce, _payload));
        // try-catch all errors/exceptions
        if (!success) {
            failedMessages[_srcChainId][_srcAddress][_nonce] = keccak256(_payload);
            emit MessageFailed(_srcChainId, _srcAddress, _nonce, _payload, reason);
        }
    }

https://github.com/code-423n4/2022-12-tigris/blob/588c84b7bb354d20cbca6034544c4faa46e6a80e/contracts/GovNFT.sol#L168

Tools Used

Recommended Mitigation Steps

• There should be a pausing mechanism so that in case of a leaked governor, another security roles are able to pause the malicious minting.
• There should be a delay between changing the address of the endpoint. Because, it is almost impossible to notice the malicious endpoint address assignment with the immediate address change. While, having a delay between setting the pending endpoint and assigning it, gives the protocol or users enough time to investigate the validity of the new endpoint address.

[c4-judge]

GalloDaSballo marked the issue as duplicate of #184

[c4-judge]

GalloDaSballo marked the issue as duplicate of #377

[c4-judge]

GalloDaSballo marked the issue as satisfactory