天象Web3安全 | 跨链桥历史安全问题

// CrossChain contract:    functionhandlePackage(        bytes calldata payload,        bytes calldata proof,        uint64 height,        uint64 packageSequence,        uint8 channelId    )        external        onlyInit        onlyRelayer        sequenceInOrder(packageSequence, channelId)        blockSynced(height)        channelSupported(channelId)        headerInOrder(height, channelId)        whenNotSuspended{        bytes memory payloadLocal = payload; // fix error: stack too deep, try removing local variables        bytes memory proofLocal = proof; // fix error: stack too deep, try removing local variables        require(            MerkleProof.validateMerkleProof(                ILightClient(LIGHT_CLIENT_ADDR).getAppHash(height),                STORE_NAME,                generateKey(packageSequence, channelId),                payloadLocal,                proofLocal            ),            "invalid merkle proof"        );        ...    }// MerkleProof: library MerkleProof {    functionvalidateMerkleProof(        bytes32 appHash,        string memory storeName,        bytes memory key,        bytes memory value,        bytes memory proof    ) internal view returns(bool) {        ...        /* solium-disable-next-line */        assembly {            // call validateMerkleProof precompile contract            // Contract address: 0x65            ifiszero(staticcall(not(0), 0x65, input, length, result, 0x20)){ }        }    /// check the proof is valid or not.        return result[0] == 0x01;    }}

// PrecompiledContractsHertz contains the default set of pre-compiled Ethereum// contracts used in the Hertz release.var PrecompiledContractsHertz = PrecompiledContracts{ common.BytesToAddress([]byte{0x1}): &ecrecover{}, common.BytesToAddress([]byte{0x2}): &sha256hash{}, common.BytesToAddress([]byte{0x3}): &ripemd160hash{}, common.BytesToAddress([]byte{0x4}): &dataCopy{}, common.BytesToAddress([]byte{0x5}): &bigModExp{eip2565: true}, common.BytesToAddress([]byte{0x6}): &bn256AddIstanbul{}, common.BytesToAddress([]byte{0x7}): &bn256ScalarMulIstanbul{}, common.BytesToAddress([]byte{0x8}): &bn256PairingIstanbul{}, common.BytesToAddress([]byte{0x9}): &blake2F{}, common.BytesToAddress([]byte{0x64}): &tmHeaderValidate{}, common.BytesToAddress([]byte{0x65}): &iavlMerkleProofValidatePlato{}, // Here common.BytesToAddress([]byte{0x66}): &blsSignatureVerify{}, common.BytesToAddress([]byte{0x67}): &cometBFTLightBlockValidateHertz{},}

func(proof *RangeProof) _computeRootHash() (rootHash []byte, treeEnd bool, err error) {iflen(proof.Leaves)== 0 {  return nil, false, cmn.ErrorWrap(ErrInvalidProof, "no leaves") }if len(proof.InnerNodes)+1 != len(proof.Leaves) {  return nil, false, cmn.ErrorWrap(ErrInvalidProof, "InnerNodes vs Leaves length mismatch, leaves should be 1 more.") }// Start from the left path and prove each leaf.// shared across recursive calls var leaves = proof.Leaves var innersq = proof.InnerNodes var COMPUTEHASH func(path PathToLeaf, rightmost bool) (hash []byte, treeEnd bool, done bool, err error)// rightmost: is the root a rightmost child of the tree?// treeEnd: true iff the last leaf is the last item of the tree.// Returns the (possibly intermediate, possibly root) hash. COMPUTEHASH = func(path PathToLeaf, rightmost bool) (hash []byte, treeEnd bool, done bool, err error) {  // Pop next leaf.  nleaf, rleaves := leaves[0], leaves[1:]  leaves = rleaves  // Compute hash.  hash = (pathWithLeaf{   Path: path,   Leaf: nleaf,  }).computeRootHash()  // If we don't have any leaves left, we're done.  if len(leaves) == 0 {   rightmost = rightmost && path.isRightmost()   return hash, rightmost, true, nil  }  // Prove along path (until we run out of leaves).  for len(path) > 0 {   // Drop the leaf-most (last-most) inner nodes from path   // until we encounter one with a left hash.   // We assume that the left side is already verified.   // rpath: rest of path   // lpath: last path item   rpath, lpath := path[:len(path)-1], path[len(path)-1]   path = rpath   if len(lpath.Right) == 0 {    continue   }   // Pop next inners, a PathToLeaf (e.g. []proofInnerNode).   inners, rinnersq := innersq[0], innersq[1:]   innersq = rinnersq   // Recursively verify inners against remaining leaves.   derivedRoot, treeEnd, done, err := COMPUTEHASH(inners, rightmost && rpath.isRightmost())   if err != nil {    return nil, treeEnd, false, cmn.ErrorWrap(err, "recursive COMPUTEHASH call")   }   if !bytes.Equal(derivedRoot, lpath.Right) {    return nil, treeEnd, false, cmn.ErrorWrap(ErrInvalidRoot, "intermediate root hash %X doesn't match, got %X", lpath.Right, derivedRoot)   }   if done {    return hash, treeEnd, true, nil   }  }  // We're not done yet (leaves left over). No error, not done either.  // Technically if rightmost, we know there's an error "left over leaves  // -- malformed proof", but we return that at the top level, below.  return hash, false, false, nil }// Verify! path := proof.LeftPath rootHash, treeEnd, done, err := COMPUTEHASH(path, true)if err != nil {  return nil, treeEnd, cmn.ErrorWrap(err, "root COMPUTEHASH call") } elseif !done {  return nil, treeEnd, cmn.ErrorWrap(ErrInvalidProof, "left over leaves -- malformed proof") }// Ok!return rootHash, treeEnd, nil}

funcsingleValueOpVerifier(op merkle.ProofOperator) error {if op == nil {  return nil }if valueOp, ok := op.(iavl.IAVLValueOp); ok {  iflen(valueOp.Proof.Leaves) != 1 {   return cmn.NewError("range proof suspended")  }  for _, innerNode := range valueOp.Proof.LeftPath {   if len(innerNode.Right) > 0 && len(innerNode.Left) > 0 {    return cmn.NewError("both right and left hash exit!")   }  } }return nil}

contract MainchainGatewayV3 is  WithdrawalLimitation,  Initializable,  AccessControlEnumerable,  IMainchainGatewayV3,  HasContracts{  ...  /**   * @dev Initializes contract storage.   */  function initialize(    address _roleSetter,    IWETH _wrappedToken,    uint256 _roninChainId,    uint256 _numerator,    uint256 _highTierVWNumerator,    uint256 _denominator,    // _addresses[0]: mainchainTokens    // _addresses[1]: roninTokens    // _addresses[2]: withdrawalUnlockers    address[][3] calldata _addresses,    // _thresholds[0]: highTierThreshold    // _thresholds[1]: lockedThreshold    // _thresholds[2]: unlockFeePercentages    // _thresholds[3]: dailyWithdrawalLimit    uint256[][4] calldata _thresholds,    Token.Standard[] calldata _standards  ) external payable virtual initializer {    _setupRole(DEFAULT_ADMIN_ROLE, _roleSetter);    roninChainId = _roninChainId;    _setWrappedNativeTokenContract(_wrappedToken);    _updateDomainSeparator();    _setThreshold(_numerator, _denominator);    _setHighTierVoteWeightThreshold(_highTierVWNumerator, _denominator);    _verifyThresholds();    if (_addresses[0].length > 0) {      // Map mainchain tokens to ronin tokens      _mapTokens(_addresses[0], _addresses[1], _standards);      // Sets thresholds based on the mainchain tokens      _setHighTierThresholds(_addresses[0], _thresholds[0]);      _setLockedThresholds(_addresses[0], _thresholds[1]);      _setUnlockFeePercentages(_addresses[0], _thresholds[2]);      _setDailyWithdrawalLimits(_addresses[0], _thresholds[3]);    }    // Grant role for withdrawal unlocker    for (uint256 _i; _i < _addresses[2].length; ) {      _grantRole(WITHDRAWAL_UNLOCKER_ROLE, _addresses[2][_i]);      unchecked {        ++_i;      }    }  }  function initializeV2(address bridgeManagerContract) external reinitializer(2){    _setContract(ContractType.BRIDGE_MANAGER, bridgeManagerContract);  }  /**   * @dev Receives ether without doing anything. Use this function to topup native token.   */  function receiveEther() external payable {} ...}

contract MainchainGatewayV3 is  WithdrawalLimitation,  Initializable,  AccessControlEnumerable,  ERC1155Holder,  IMainchainGatewayV3,  HasContracts,  IBridgeManagerCallback{  ...  /**   * @dev Initializes contract storage.   */  function initialize(    address _roleSetter,    IWETH _wrappedToken,    uint256 _roninChainId,    uint256 _numerator,    uint256 _highTierVWNumerator,    uint256 _denominator,    // _addresses[0]: mainchainTokens    // _addresses[1]: roninTokens    // _addresses[2]: withdrawalUnlockers    address[][3] calldata _addresses,    // _thresholds[0]: highTierThreshold    // _thresholds[1]: lockedThreshold    // _thresholds[2]: unlockFeePercentages    // _thresholds[3]: dailyWithdrawalLimit    uint256[][4] calldata _thresholds,    TokenStandard[] calldata _standards  ) external payable virtual initializer {    _setupRole(DEFAULT_ADMIN_ROLE, _roleSetter);    roninChainId = _roninChainId;    _setWrappedNativeTokenContract(_wrappedToken);    _updateDomainSeparator();    _setThreshold(_numerator, _denominator);    _setHighTierVoteWeightThreshold(_highTierVWNumerator, _denominator);    _verifyThresholds();    if (_addresses[0].length > 0) {      // Map mainchain tokens to ronin tokens      _mapTokens(_addresses[0], _addresses[1], _standards);      // Sets thresholds based on the mainchain tokens      _setHighTierThresholds(_addresses[0], _thresholds[0]);      _setLockedThresholds(_addresses[0], _thresholds[1]);      _setUnlockFeePercentages(_addresses[0], _thresholds[2]);      _setDailyWithdrawalLimits(_addresses[0], _thresholds[3]);    }    // Grant role for withdrawal unlocker    for (uint256 i; i < _addresses[2].length; i++) {      _grantRole(WITHDRAWAL_UNLOCKER_ROLE, _addresses[2][i]);    }  }  function initializeV2(address bridgeManagerContract) external reinitializer(2){    _setContract(ContractType.BRIDGE_MANAGER, bridgeManagerContract);  }  function initializeV3() external reinitializer(3){    IBridgeManager mainchainBridgeManager = IBridgeManager(getContract(ContractType.BRIDGE_MANAGER));    (, address[] memory operators, uint96[] memory weights) = mainchainBridgeManager.getFullBridgeOperatorInfos();    uint96 totalWeight;    for (uint i; i < operators.length; i++) {      _operatorWeight[operators[i]] = weights[i];      totalWeight += weights[i];    }    _totalOperatorWeight = totalWeight;  }  function initializeV4(address payable wethUnwrapper_) external reinitializer(4){    wethUnwrapper = WethUnwrapper(wethUnwrapper_);  }  /**   * @dev Receives ether without doing anything. Use this function to topup native token.   */  function receiveEther() external payable { }  ... }

/**   * @inheritdoc IMainchainGatewayV3   */  function submitWithdrawal(    Transfer.Receipt calldata _receipt,    Signature[] calldata _signatures  ) external virtual whenNotPaused returns(bool _locked) {    return _submitWithdrawal(_receipt, _signatures);  }   /**   * @dev Submits withdrawal receipt.   *   * Requirements:   * - The receipt kind is withdrawal.   * - The receipt is to withdraw on this chain.   * - The receipt is not used to withdraw before.   * - The withdrawal is not reached the limit threshold.   * - The signer weight total is larger than or equal to the minimum threshold.   * - The signature signers are in order.   *   * Emits the `Withdrew` once the assets are released.   *   */  function _submitWithdrawal(    Transfer.Receipt calldata _receipt,    Signature[] memory _signatures  ) internalvirtualreturns(bool _locked){    uint256 _id = _receipt.id;    uint256 _quantity = _receipt.info.quantity;    address _tokenAddr = _receipt.mainchain.tokenAddr;    _receipt.info.validate();    if (_receipt.kind != Transfer.Kind.Withdrawal) revert ErrInvalidReceiptKind();    if (_receipt.mainchain.chainId != block.chainid) {      revert ErrInvalidChainId(msg.sig, _receipt.mainchain.chainId, block.chainid);    }    MappedToken memory _token = getRoninToken(_receipt.mainchain.tokenAddr);    if (!(_token.erc == _receipt.info.erc && _token.tokenAddr == _receipt.ronin.tokenAddr)) revert ErrInvalidReceipt();    if (withdrawalHash[_id] != 0) revert ErrQueryForProcessedWithdrawal();    if (!(_receipt.info.erc == Token.Standard.ERC721 || !_reachedWithdrawalLimit(_tokenAddr, _quantity))) {      revert ErrReachedDailyWithdrawalLimit();    }    bytes32 _receiptHash = _receipt.hash();    bytes32 _receiptDigest = Transfer.receiptDigest(_domainSeparator, _receiptHash);    uint256 _minimumVoteWeight;    (_minimumVoteWeight, _locked) = _computeMinVoteWeight(_receipt.info.erc, _tokenAddr, _quantity);    {      bool _passed;      address _signer;      address _lastSigner;      Signature memory _sig;      uint256 _weight;      for (uint256 _i; _i < _signatures.length; ) {        _sig = _signatures[_i];        _signer = ecrecover(_receiptDigest, _sig.v, _sig.r, _sig.s);        if (_lastSigner >= _signer) revert ErrInvalidOrder(msg.sig);        _lastSigner = _signer;        _weight += _getWeight(_signer);        if (_weight >= _minimumVoteWeight) {          _passed = true;          break;        }        unchecked {          ++_i;        }      }      if (!_passed) revert ErrQueryForInsufficientVoteWeight();      withdrawalHash[_id] = _receiptHash;    }    if (_locked) {      withdrawalLocked[_id] = true;      emit WithdrawalLocked(_receiptHash, _receipt);      return _locked;    }    _recordWithdrawal(_tokenAddr, _quantity);    _receipt.info.handleAssetTransfer(payable(_receipt.mainchain.addr), _tokenAddr, wrappedNativeToken);    emit Withdrew(_receiptHash, _receipt);  }

/**   * @dev Returns the minimum vote weight for the token.   */  function _computeMinVoteWeight(    Token.Standard _erc,    address _token,    uint256 _quantity  ) internal virtualreturns(uint256 _weight, bool _locked){    uint256 _totalWeight = _getTotalWeight();    _weight = _minimumVoteWeight(_totalWeight);    if (_erc == Token.Standard.ERC20) {      if (highTierThreshold[_token] <= _quantity) {        _weight = _highTierVoteWeight(_totalWeight);      }      _locked = _lockedWithdrawalRequest(_token, _quantity);    }  }  /**   * @inheritdoc GatewayV3   */  function _getTotalWeight() internal view overridereturns(uint256){    return _totalOperatorWeight;  }  function _minimumVoteWeight(uint256 _totalWeight) internal view virtualreturns(uint256){    return (_num * _totalWeight + _denom - 1) / _denom;  }