_callOut function encodes the wrong flag based on the anyExecute function

[code423n4]

Lines of code

https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/BranchBridgeAgent.sol#L657
https://github.com/code-423n4/2023-05-maia/blob/54a45beb1428d85999da3f721f923cbf36ee3d35/src/ulysses-omnichain/BranchBridgeAgent.sol#L1118-L1224

Vulnerability details

Impact

The _callOut function of the BranchBridgeAgent contract encodes the wrong selector for messages with no asset settlement. The effect of encoding 0x01 as the flag will cause the code block that invokes the executeWithSettlement function to be executed when the anyExecute function is ultimately invoked on the destination chain. The implications this will have for the protocol are two-fold:

1. Users can pass any calldata as a parameter to the external callOut function that will then be encoded within the internal _callOut function. A malicious user can populate this calldata with parameters that will populate the SettlementParams struct within the executeWithSettlement function with data that will cause token transfers to occur on the destination chain without having to transfer any tokens to the protocol. This can then be used to drain the protocol of its liquidity.

2. Users that intend to use the external callout function to send a cross-chain message without an asset transfer will lose the funds sent to pay for the message's gas fee because the transaction will likely fail execution on the destination chain due to the encoded calldata not having the correct encoded parameters to create the SettlementParams struct within the executeWithSettlement function.

We believe this to be a high-severity vulnerability because it will have a direct effect on user funds as well as the functionality of the protocol.

Proof of Concept

Please see the previously referenced blocks of code.

Tools Used

Manual Audit Review

Recommended Mitigation Steps

Refactor the anyExecute function of the BranchBridgeAgent contract so that the intended functionality is invoked with the 0x01 flag allowing it to be in alignment with the respective functionality of the anyExecute function of the
RootBridgeAgent contract.

Assessed type

Error

[c4-judge]

trust1995 marked the issue as duplicate of #91

[c4-judge]

trust1995 marked the issue as satisfactory