You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Jun 29, 2023. It is now read-only.
Some of these contracts have no access controls. Which might be a potential attack vector. This issue consolidate those contracts
SpokeRegistry
SpokeRegistry register spoke contracts and maps a spokeID to a spoke contract. Once a spoke is registered, people can send massMigration to migrate their tokens from Hubble to the spoke.
No access control means anyone can register malicious spoke contracts.
tokenRegistry
No access control means anyone can register malicious ERC20 token.
How can we fix it
We don't have governance and we don't want to assign that access to a particular entity.
One way to fix this is to determine all the spokes and the tokens at the deployment and no one are allowed to add new tokens in the future.
The text was updated successfully, but these errors were encountered:
What's wrong
Some of these contracts have no access controls. Which might be a potential attack vector. This issue consolidate those contracts
SpokeRegistry
SpokeRegistry register spoke contracts and maps a spokeID to a spoke contract. Once a spoke is registered, people can send massMigration to migrate their tokens from Hubble to the spoke.
No access control means anyone can register malicious spoke contracts.
tokenRegistry
No access control means anyone can register malicious ERC20 token.
How can we fix it
We don't have governance and we don't want to assign that access to a particular entity.
One way to fix this is to determine all the spokes and the tokens at the deployment and no one are allowed to add new tokens in the future.
The text was updated successfully, but these errors were encountered: