Full Report
Enzyme Finance is an asset management built on Ethereum. Anyone can create, manage or invest using custom investment strategies with a variety of assets. The tool is designed to make it easy to investors to track and manage their portfolios. The Gas Station Network (GSN) allows gasless clients to interact with Ethereum. In order to do this, they use meta-transactions. This is when a user signs a message but a relayer sends it and pays the gas for it. The execution of the meta-transaction must come from a privileged user, since it it's a sensitive operation. To implement this sensitive operation, use _msgSender() instead of msg.sender. By using this, it will use the real msg.sender or the trusted forwarded from the SGN network. Within the ecosystem, there are a few parties: Paymaster: Ethereum balance of the RelayHub. Determines whether gas will be refunded or not. Trusted Forwarder: Verify users signatures on the message. Relay Hub: Oversees all of the components of the SGN. Relay Server: Main interaction with the client. Get the signed message from the user and give them the receipt. The vulnerability is that the Trusted Forwarder check was not being made from the context of the paymaster. Luckily though, the transactions still need to be signed by other users, making this not trivial to exploit. To steal funds, an attacker can execute a transaction then ask for a large gas refund. Overall, an access control bug in a complicated architecture.
Analysis Summary