SDK - deBridge Cross Chain Swaps

It is observed that in forward() and swapAndSend() functions inside ReceivingForwarder.sol and in CrosschainForwarder.sol does not check if source token type equals to destination token type and accepts same pair of tokens as input.

This type of bugs may lead to critical attack vectors or griefing attacks.

Code Location

ReceivingForwarder.sol

• forward

ReceivingForwarder.sol

    function forward(
        address _dstTokenIn,
        address _router,
        bytes memory _routerCalldata,
        address _dstTokenOut,
        address _fallbackAddress
    ) external payable override{
        if (_dstTokenIn == NATIVE_TOKEN) {
            return _forwardFromETH(
                _router,
                _routerCalldata,
                _dstTokenOut,
                _fallbackAddress
            );
        }
        else {
            return _forwardFromERC20(
                IERC20Upgradeable(_dstTokenIn),
                _router,
                _routerCalldata,
                _dstTokenOut,
                _fallbackAddress
            );

CrosschainForwarder.sol

• swapAndSend

LPConnector.sol

    function swapAndSend(
        address _srcTokenIn,
        uint _srcAmountIn,
        bytes memory _srcTokenInPermit,
        address _srcSwapRouter,
        bytes calldata _srcSwapCalldata,
        address _srcTokenOut,
        bytes calldata _dstDetails
    ) external payable override {
        if (!supportedRouters[_srcSwapRouter]) revert NotSupportedRouter();

        uint ethBalanceBefore = address(this).balance - msg.value;
        uint srcAmountOut;

        if (_srcTokenIn == NATIVE_TOKEN) {
            _validateSrcETHIn(_srcAmountIn);
            srcAmountOut = _swapToERC20Via(
                _srcSwapRouter,
                _srcSwapCalldata,
                _srcAmountIn,
                IERC20Upgradeable(_srcTokenOut)
            );
        }
        else {
            ...

In the Proof of Concept below, we created a test script which gives same input token type for source and destination.

Proof of concept

    it('Same pair of tokens', async () => {
      await state.usdToken.instance.mint(state.user.address,usd2v(10));
      console.log(await state.usdToken.instance.balanceOf(state.user.address));

      await state.receivingForwarder.instance.connect(state.user)
        .forward(
          state.usdToken.instance.address, // _wrappedToken
          state.dex.instance.address, // _router
          SAMPLE_CALLDATA.swap.sample, // _routerCalldata
          state.usdToken.instance.address, // _targetToken
          state.user.address, // _fallbackAddress
        );

        console.log(await state.usdToken.instance.balanceOf(state.user.address));
    });

NOT APPLICABLE: The issue is marked as not applicable by the DeBridge team with an explanation: Both CrosschainForwarder and ReceivingForwarder work as relayers: they take tokenIn from msg.sender, swap it to tokenOut via the swapRouter, then pass the resulting tokenOut along with deBridgeGate or the destination address. It seems that there is nothing wrong with the situation when both tokens are the same. Moreover, this opens broad possibilities for arbitrage.