Merge pull request #141 from hansstammler/feat_issue_128

feat #128: renamed contracts and added assertions
mojtaba-eshghie · Jun 24, 2024 · 00825ca · 00825ca
2 parents b864959 + 35a6dfc
commit 00825ca
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 14 deletions.
diff --git a/CI/tests/Bridge.exploit1.js b/CI/tests/Bridge.exploit1.js
@@ -91,8 +91,8 @@ async function sequence(contractsA, contractsB, web3A, web3B){
 
     let balance2 = await web3B.eth.getBalance(vaultB._address); 
     console.log(balance2);
-    let balance3 = await web3B.eth.getBalance(accountB);
-    console.log(balance3);
+    assert(balance2 == 99500, "Value was not 99500 as expected: " + balance2);
+    return balance2 == 99500;
 }
 
 async function callSmartContract(method, sender, value = 0){
@@ -116,7 +116,7 @@ async function startUp() {
     bridgeTestLogger.debug("Web3 A: " + envAnvil.envInfo.rpcAddress);
     bridgeTestLogger.debug("Web3 B: " + envAvalanche.envInfo.rpcAddress);
 
-    let contractsA = await deployBridge(envAnvil.web3, envAnvil.envInfo, 'A', 'ETH', 'EthRouterExploit1', 'EthVaultOracle', 'Oracle', 'eth_bridgeForwards', 'eth_bridgeForwardsERC20');
+    let contractsA = await deployBridge(envAnvil.web3, envAnvil.envInfo, 'A', 'ETH', 'EthRouterVulnerability1', 'EthVaultOracle', 'Oracle', 'eth_bridgeForwards', 'eth_bridgeForwardsERC20');
     let contractsB = await deployBridge(envAvalanche.web3, envAvalanche.envInfo, 'B', 'AVAX', 'AvaxRouter', 'AvaxVaultOracle', 'Oracle', 'avax_bridgeForwards', 'avax_bridgeForwardsERC20');
 
     let contractSourceA = fs.readFileSync(path.join('contracts', 'src', 'cross-chain', 'EthRouter.sol'), 'utf8');

diff --git a/CI/tests/Bridge.exploit2.js b/CI/tests/Bridge.exploit2.js
@@ -89,14 +89,14 @@ async function sequence(contractsA, contractsB, web3A, web3B){
         from: accountA,
         gas: 300000,
         value: 100
-    });3
+    });
 
     await sleep(5000);
 
     let balance2 = await web3B.eth.getBalance(vaultB._address); 
     console.log(balance2);
-    let balance3 = await web3B.eth.getBalance(accountB);
-    console.log(balance3);
+    assert(balance2 == 99750, "Value was not 99750 as expected: " + balance2);
+    return balance2 == 99750;
 }
 
 async function callSmartContract(method, sender, value = 0){
@@ -120,7 +120,7 @@ async function startUp() {
     bridgeTestLogger.debug("Web3 A: " + envAnvil.envInfo.rpcAddress);
     bridgeTestLogger.debug("Web3 B: " + envAvalanche.envInfo.rpcAddress);
 
-    let contractsA = await deployBridge(envAnvil.web3, envAnvil.envInfo, 'A', 'ETH', 'EthRouterExploit2', 'EthVaultOracle', 'Oracle', 'eth_bridgeForwards', 'eth_bridgeForwardsERC20');
+    let contractsA = await deployBridge(envAnvil.web3, envAnvil.envInfo, 'A', 'ETH', 'EthRouterVulnerability2', 'EthVaultOracle', 'Oracle', 'eth_bridgeForwards', 'eth_bridgeForwardsERC20');
     let contractsB = await deployBridge(envAvalanche.web3, envAvalanche.envInfo, 'B', 'AVAX', 'AvaxRouter', 'AvaxVaultOracle', 'Oracle', 'avax_bridgeForwards', 'avax_bridgeForwardsERC20');
 
     let contractSourceA = fs.readFileSync(path.join('contracts', 'src', 'cross-chain', 'EthRouter.sol'), 'utf8');

diff --git a/...cts/src/cross-chain/EthRouterExploit1.sol → ...c/cross-chain/EthRouterVulnerability1.sol b/...cts/src/cross-chain/EthRouterExploit1.sol → ...c/cross-chain/EthRouterVulnerability1.sol
@@ -7,7 +7,7 @@ interface iERC20 {
     function transfer(address, uint256) external returns (bool success);
 }
 
-contract EthRouterExploit1 {
+contract EthRouterVulnerability1 {
     //This keeps track of bridge-owned token, is burned
     address public CrossToken;
 

diff --git a/...cts/src/cross-chain/EthRouterExploit2.sol → ...c/cross-chain/EthRouterVulnerability2.sol b/...cts/src/cross-chain/EthRouterExploit2.sol → ...c/cross-chain/EthRouterVulnerability2.sol
@@ -7,7 +7,7 @@ interface iERC20 {
     function transfer(address, uint256) external returns (bool success);
 }
 
-contract EthRouterExploit2 {
+contract EthRouterVulnerability2 {
     //This keeps track of bridge-owned token, is burned
     address public CrossToken;
 
@@ -106,11 +106,8 @@ contract EthRouterExploit2 {
         string memory memo,
         uint expiration
     ) external payable {
-        unchecked {
-            require(expiration - block.timestamp >= 0, "Deposit request expired");
-            eth_deposit(vault, asset, amount, memo);
-        }
-
+        require(block.timestamp > expiration, "Deposit request expired");
+        eth_deposit(vault, asset, amount, memo);
     }
 
     //Called by a vault to pay out funds to indicated address