Omniscia Sova Network Audit

ManagedWithdrawRWAStrategy Manual Review Findings

ManagedWithdrawRWAStrategy Manual Review Findings

MWW-01M: Cross-Chain Replay Attack Susceptible Domain Separator

Description:

The domain separator calculated within the ManagedWithdrawReportedStrategy contract will remain constant regardless of the underlying blockchain state, resulting in forked blockchains to utilize the same domain separator erroneously.

Impact:

In the event of a blockchain fork, the domain separator will deviate from the EIP-712 standard and permit signature replays across chains.

Example:

src/strategy/ManagedWithdrawRWAStrategy.sol
71/**
72 * @notice Initialize the strategy with ManagedWithdrawRWA token
73 * @param name_ Name of the token
74 * @param symbol_ Symbol of the token
75 * @param roleManager_ Address of the role manager
76 * @param manager_ Address of the manager
77 * @param asset_ Address of the underlying asset
78 * @param assetDecimals_ Decimals of the asset
79 * @param initData Additional initialization data (unused)
80 */
81function initialize(
82    string calldata name_,
83    string calldata symbol_,
84    address roleManager_,
85    address manager_,
86    address asset_,
87    uint8 assetDecimals_,
88    bytes memory initData
89) public override {
90    super.initialize(name_, symbol_, roleManager_, manager_, asset_, assetDecimals_, initData);
91

92    // Initialize EIP-712 domain separator
93    DOMAIN_SEPARATOR = keccak256(
94        abi.encode(
95            EIP712_DOMAIN_TYPEHASH,
96            keccak256(bytes("ManagedWithdrawReportedStrategy")),
97            keccak256(bytes("V1")),
98            block.chainid,
99            address(this)
100        )
101    );
102}

Recommendation:

We advise the code to re-calculate the domain separator if the block.chainid changes, ensuring that the domain separator remains correct across any potential future blockchain forks.

Alleviation (e4d6885477438291b0d3ca477fab7e088522967b):

The code as updated to utilize a dynamically-calculated domain separator at all times, alleviating this exhibit.

Prev

ManagedWithdrawRWA.sol (MWR-M)

Next

PriceOracleReporter.sol (POR-M)

On this page