Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[KGA-29] [KGA-136] fix: cases with Cairo precompiles and delegatecalls #1567

Merged
merged 11 commits into from
Nov 15, 2024
Merged

[KGA-29] [KGA-136] fix: cases with Cairo precompiles and delegatecalls #1567

merged 11 commits into from
Nov 15, 2024

Conversation

enitrat
Copy link
Collaborator

@enitrat enitrat commented Nov 4, 2024 •
edited by obatirou
Loading

Fixes the issue raised during the audit about eventual honeypots that could lure a user and manipulate starknet tokens without explicit approvals

  1. Remove dependence on the code_address for whitelisting, which were reported dangerous.
  2. Disable ability of having nesting a delegatecall to 0x75001 at protocol level. (no longer possible to do User A -call-> contract C -delegatecall->DualVmToken -delegatecall->0x75001 as a byproduct of 1.
  3. Added noDelegateCall modifier to L2KakarotMessaging and DualVMToken for extra security
  4. Added associated tests under Security/

code-423n4/2024-09-kakarot-findings#38
code-423n4/2024-09-kakarot-findings#124

Closes #1562

This change is Reviewable

@enitrat enitrat force-pushed the fix/nodelegatecall-whitelisted-precompiles branch from 6fe6ce4 to 5ee817b Compare November 4, 2024 07:43
@codecov Codecov
Copy link

codecov bot commented Nov 4, 2024 •
edited
Loading

Codecov Report

Attention: Patch coverage is 54.54545% with 5 lines in your changes missing coverage. Please review.

Project coverage is 63.6%. Comparing base (289c2e8) to head (8f983aa).
Report is 5 commits behind head on main.

Files with missing lines Patch % Lines
cairo_zero/kakarot/interpreter.cairo 0.0% 4 Missing ⚠️
...zero/kakarot/precompiles/precompiles_helpers.cairo 83.3% 1 Missing ⚠️
Additional details and impacted files 
@@          Coverage Diff          @@
##            main   #1567   +/-   ##
=====================================
  Coverage   63.6%   63.6%           
=====================================
  Files         44      44           
  Lines       8343    8341    -2     
=====================================
+ Hits        5309    5313    +4     
+ Misses      3034    3028    -6

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@enitrat enitrat changed the title fix: add NoDelegateCall modifiers to DualVMToken [KGA-29] fix: add NoDelegateCall modifiers to DualVMToken Nov 5, 2024
@notion-workspace Notion Workspace
Copy link

Kakarot precompiles can be abused by malicious contracts by delegate-calling whitelisted contracts

@obatirou obatirou changed the title [KGA-29] fix: add NoDelegateCall modifiers to DualVMToken [KGA-29] [KGA-136] fix: add NoDelegateCall modifiers to DualVMToken Nov 5, 2024
@notion-workspace Notion Workspace
Copy link

Unauthorized Contracts Can Bypass Precompile Authorization via delegatecall in Kakarot zkEVM

@enitrat enitrat force-pushed the fix/nodelegatecall-whitelisted-precompiles branch from 94f8c6d to 7d316cd Compare November 12, 2024 09:48
@obatirou obatirou force-pushed the fix/nodelegatecall-whitelisted-precompiles branch from 7d316cd to 2e14113 Compare November 12, 2024 13:35
@obatirou
Copy link
Collaborator

obatirou commented Nov 13, 2024 •
edited
Loading

All relevant end to end tests passes but there is problems with relayers cc @ClementWalter

@obatirou obatirou force-pushed the fix/nodelegatecall-whitelisted-precompiles branch 2 times, most recently from 9596703 to 78e4ab3 Compare November 14, 2024 10:33
ClementWalter
ClementWalter previously approved these changes Nov 14, 2024
View reviewed changes
Copy link
Member

@ClementWalter ClementWalter left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok for me, I was a bit surprised in the beginning in the tests/end_to_end/NoDelegateCall/test_dual_vm_token_hack.py test that the test was failing with and without the modifier, but it's because we also did the modif in cairo to remediate the issue

@enitrat enitrat changed the title [KGA-29] [KGA-136] fix: add NoDelegateCall modifiers to DualVMToken [KGA-29] [KGA-136] fix: ensure precompiles cannot be called by nesting delegatecalls Nov 15, 2024
@enitrat enitrat changed the title [KGA-29] [KGA-136] fix: ensure precompiles cannot be called by nesting delegatecalls [KGA-29] [KGA-136] fix: cases with Cairo precompiles and delegatecalls Nov 15, 2024
@enitrat enitrat merged commit 8e37d05 into main Nov 15, 2024
16 checks passed
@enitrat enitrat deleted the fix/nodelegatecall-whitelisted-precompiles branch November 15, 2024 03:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@obatirou obatirou obatirou left review comments

@ClementWalter ClementWalter ClementWalter left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

bug: Kakarot precompiles can be abused by malicious contracts by delegate-calling whitelisted contracts[2]
3 participants
@enitrat @obatirou @ClementWalter