Poly Network exploit

Exploits

Poly NetworkAug 10, 2021

$611M lost#4 on rekt.newsFunds returned

Overview

Lost

$611M

#4 on the rekt.news leaderboard

Came back

$611M

Funds returned

Attacked

EthCrossChainData.putCurEpochConPubKeyBytes

Access control: privileged target

Audit

Unaudited

EthereumBSCPolygon

What happened

EthCrossChainManager executes cross-chain messages by calling whatever contract a message names, and it owned EthCrossChainData, the contract holding the keepers' public keys. A message aimed at EthCrossChainData, with a method name chosen so its 4-byte selector matched putCurEpochConPubKeyBytes(bytes), replaced the keepers with the attacker's key; the attacker then signed withdrawals from LockProxy on three chains.

bridgecross-chain messageselector collisionownership

Timeline

Aug 10, 2021Assets taken from LockProxy on Ethereum, BSC and Polygon, about $611M.
Aug 11, 2021The attacker starts returning the funds.
Aug 23, 2021The attacker shares the key to the last assets, held in a shared account.
Aug 25, 2021The last assets are back with Poly Network.

Attack flow

A message that rewrote the keepersmissing check

Attacker

Relayers

EthCrossChainManager

EthCrossChainData

LockProxy

What happens

1
send()
Relayers.send
Sends a cross-chain transaction from another chain. Its target is EthCrossChainData; its method name was searched for until its 4-byte selector equalled that of putCurEpochConPubKeyBytes(bytes).
2
verifyHeaderAndExecuteTx()
EthCrossChainManager.verifyHeaderAndExecuteTx
The message is carried and signed like any other, and the manager verifies and executes it: it calls the named target with a selector built from the method name. The only check on the target is that it is a contract.
Missing check. Any contract could be the target, including the manager's own key store.
3
putCurEpochConPubKeyBytes()
EthCrossChainData.putCurEpochConPubKeyBytes
The call comes from EthCrossChainManager, EthCrossChainData's owner, so onlyOwner passes: the keepers' public keys are replaced with the attacker's.
Missing check. The owner of the key store was a contract that executes arbitrary messages.
4
verifyHeaderAndExecuteTx()
EthCrossChainManager.verifyHeaderAndExecuteTx
Now the keeper, the attacker signs withdrawal messages, and the manager accepts them.
5
unlock()
LockProxy.unlock
LockProxy releases the locked assets to the attacker. The same was repeated on BSC and Polygon.

Funds

Balance changes and fund flow, from the sources

PartyAssetValueNet

Poly Network LockProxyLostEthereum: ETH and tokensBSC: tokensPolygon: USDC−$273M−$253M−$85M−$611M

AttackerGainedThe same assets+$611M+$611M

Returned to Poly NetworkGot backReturned between August 11 and 25, 2021.All the assets+$611M+$611M

Fund flow, in order

[1] $611M on 3 chains[2] $611M returned

Poly Network LockProxy−$611M

Attacker+$611M

Returned to Poly Network+$611M

Root cause

EthCrossChainManager (Poly Network) · illustrative, written to the pattern

11function _executeCrossChainTx(address _toContract, bytes memory _method, bytes memory _args) internal returns (bool) {

22 require(Utils.isContract(_toContract), "The passed in address is not a contract!");

3− // the selector comes from a method name the message chose

3+ // messages reach registered applications only, never the bridge's own contracts

4+ require(_toContract != address(EthCrossChainData), "privileged target");

5+ require(allowedTarget[_toContract], "target not allowed");

Missing check. Any contract could be the target, including the manager's own key store.

Missing check. The owner of the key store was a contract that executes arbitrary messages.

46 bytes4 selector = bytes4(keccak256(abi.encodePacked(_method, "(bytes,bytes,uint64)")));

57 (bool ok, ) = _toContract.call(abi.encodePacked(selector, _args));

68 return ok;

79}

Why it broke

A selector is only four bytes, so a name colliding with any function can be searched for; and the contract allowed to change the keepers would call any contract a message named. Together, a message could rewrite the keepers.

Catch it

Tests of intended behaviour, never attack code

The invariant that would have failed

The keeper set changes only through the keeper-change flow, signed by the current keepers.

As a Foundry test· illustrative, write it against your own contracts

function test_message_cannotReachTheKeyStore() public {    bytes memory message = _messageTo(address(ccData)); // any method name    vm.expectRevert("privileged target");    manager.verifyHeaderAndExecuteTx(message, proof, header, headerProof, curHeader, headerSig);}

What an auditor checks0/3

List what a message executor can call. "The target is a contract" is not access control: allow-list the targets and exclude the bridge's own contracts.
Find who owns the contract holding validator keys, and whether that owner can be made to call it on someone else's behalf.
Calls built from user-chosen names can reach any 4-byte selector: bind messages to specific functions, not names.

In Luora. Atlas Map shows which contract owns the key store and what it calls; Paths for the message entry point shows a low-level call to a target taken from the message, the line to stop at.

Sources

Exploits

Poly NetworkAug 10, 2021

$611M lost#4 on rekt.newsFunds returned

Overview

Lost

$611M

#4 on the rekt.news leaderboard

Came back

$611M

Funds returned

Attacked

EthCrossChainData.putCurEpochConPubKeyBytes

Access control: privileged target

Audit

Unaudited

EthereumBSCPolygon

What happened

bridgecross-chain messageselector collisionownership

Timeline

Aug 10, 2021Assets taken from LockProxy on Ethereum, BSC and Polygon, about $611M.
Aug 11, 2021The attacker starts returning the funds.
Aug 23, 2021The attacker shares the key to the last assets, held in a shared account.
Aug 25, 2021The last assets are back with Poly Network.

Attack flow

A message that rewrote the keepersmissing check

Attacker

Relayers

EthCrossChainManager

EthCrossChainData

LockProxy

What happens

1
send()
Relayers.send
Sends a cross-chain transaction from another chain. Its target is EthCrossChainData; its method name was searched for until its 4-byte selector equalled that of putCurEpochConPubKeyBytes(bytes).
2
verifyHeaderAndExecuteTx()
EthCrossChainManager.verifyHeaderAndExecuteTx
The message is carried and signed like any other, and the manager verifies and executes it: it calls the named target with a selector built from the method name. The only check on the target is that it is a contract.
Missing check. Any contract could be the target, including the manager's own key store.
3
putCurEpochConPubKeyBytes()
EthCrossChainData.putCurEpochConPubKeyBytes
The call comes from EthCrossChainManager, EthCrossChainData's owner, so onlyOwner passes: the keepers' public keys are replaced with the attacker's.
Missing check. The owner of the key store was a contract that executes arbitrary messages.
4
verifyHeaderAndExecuteTx()
EthCrossChainManager.verifyHeaderAndExecuteTx
Now the keeper, the attacker signs withdrawal messages, and the manager accepts them.
5
unlock()
LockProxy.unlock
LockProxy releases the locked assets to the attacker. The same was repeated on BSC and Polygon.