RouterFacet Manual Review Findings

RFT-01M: Potentially Improper Hash Consumption

Description:

The validateAndStoreTx function will cause subsequent claims for the same hash to be nullified, however, the actual transaction hash that was used for the claim is not consumed. This can cause the same transaction hash to be utilized for a mint and burn operation (i.e. if a malicious user groups both events in the same TX via a smart contract).

Example:

Copy
299function validateAndStoreTx(bytes32 _ethHash, bytes[] calldata _signatures)
300    internal
301{
302    LibRouter.Storage storage rs = LibRouter.routerStorage();
303    LibGovernance.validateSignatures(_ethHash, _signatures);
304    rs.hashesUsed[_ethHash] = true;
305}

Recommendation:

We advise this possibility to be prevented by also setting the transaction hash as consumed which should be unique per blockchain.

Alleviation:

The Limechain team stated that this is indeed desired behaviour as they envision scenarios whereby a single transaction bridges multiple assets validly. To account for a potential mis-implementation on the node side, additional e2e tests will be created for the node implementation of Hedera to validate such edge cases.