Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Considering using EIP165 Interface Detection instead of call any interface of any target contract in V3 #268

Open
hackfisher opened this issue Jun 3, 2024 · 1 comment
Assignees

Comments

@hackfisher
Copy link

hackfisher commented Jun 3, 2024

https://github.com/msgport/msgport/blob/54a9bfd95694d2ebef61ef7f2ef3f0303818876f/src/ports/base/BaseMessagePort.sol#L47

Because many contract authorise by verifying msg.sender, call any interface of any target contract will make the Port (and ORMP) being able to used by anyone as caller, and developer is very difficult to find all the contracts which granted configs and special auths to the Port (and ORMP), this addresses need to be put in the target/callee blacklist.

Adoption EIP165 Interface Detection will be a safer and easier solution although it may introduce some incompatibility in Application and message encoding(no interface sig needed)

@hackfisher hackfisher changed the title Considering using EIP165 Interface Detection instead of call any interface of any target contract Considering using EIP165 Interface Detection instead of call any interface of any target contract in V3 Jun 3, 2024
@hujw77
Copy link
Contributor

hujw77 commented Jun 3, 2024

The V2 version also has the possibility of front-running, which is possible if an attacker performs a setAppConfig operation on a newly deployed ORMP protocol before the ORMP-U port is upgraded.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants