anurag

@anurag

Joined on Jul 22, 2019

  • Researcher/Reporter/White hacker: Ashiq Amien from iosiro on HackerOne On Aug 4th, Ashiq Amien reported a Denial of Service vulnerability on the Polygon staking contracts via the HackerOne portal. The HackerOne team triages bug reports on a regular basis and assigns them to the Polygon team only if the reported bug is within the scope of bounty. Due to a triage delay on HackerOne and the nature of the vulnerability, Ashiq reached out to samczsun for further help on Aug 17th. samczsun and Georgios Konstantopoulos immediately reached out to Mihailo, and we created a group with Ashiq to fix it. After checking with Ashiq, we concluded that StakeManagerProxy was initialized properly. However, the StakeManager implementation was not initialized. In many cases, it is not needed. But this case was different. StakeManager implementation contains extensionCode, which extends the contract and calls a few functions on extensionCode contract using delegation call. So now anyone could call the initialize implementation code with malicious extensionCode contract and selfdestruct implementation contract, which makes the StakeManagerProxy temporarily unusable until a new StakeManager implementation contract is deployed. Contract: https://etherscan.io/address/0xd6F5c46d4E1a02f9D145cEe41d2F8AF30D8d2d76 The issue was fixed by initializing the StakeManager implementation with a safe contract which doesn’t have selfdestruct (it has been set to the Matic Token contract). Here is the transaction: https://etherscan.io/tx/0x1986576e99261fdf17ae56f033d9f23fda131fab849ab62dff055205c2e438d0
     Like  Bookmark