- Type: Exploit
- Network: Polygon
- Total lost: 19M QI + 24 WETH + 563K USDC + 11K MATIC + more...
- Category: Data validation
- Exploited contracts:
- Attack transactions:
- Attacker Addresses:
- Attack Block:: 24685148
- Date: Feb 08, 2022
- Reproduce:
forge test --match-contract Exploit_Superfluid -vvv
- Craft a
Contextwith a forgedmsg.sender - Get it authorized via the host contract
This attack relies on a problem in the serialization of the ctx in the Host contract. To understand this, we need to know that Superfluid.sol allows composing agreements from different Super Apps in a single transaction.
To mantain a state throught the different calls to different Supper Apps, this ctx is set by the Host contract.
Nevertheless, it was possible for the attacker to construct an initial ctx that impersonated any user.
The problem can be seen in the updateSubscription method, which uses the AgreementLibrary to authorizeTokenAccess.
Unfortunately, this method does not authorize much besides requiring that the call comes from a particular address.
The attacker can now send a crafted message that set's anyone as the publisher.
- The
git blameof this fix is quite straightforward: theauthorizeTokenAccesshas to actually call theHostto make sure this context has been aproved by it.
