Registry Manual Review Findings

RYR-01M: Strategy Token Impersonation Attack

Type	Severity	Location
Logical Fault		Registry.sol:L96-L101

Description:

The Registry::isStrategyToken function is a significant security validation mechanism that is invoked by the Conduit::collectDeposit function to validate deposit collection operations by various tRWA instances.

In its current implementation, a malicious smart contract can impersonate a strategy token as the function performs one-way validation of the ItRWA::strategy value yielded by the token thus trusting the call's input blindly.

Impact:

It is presently possible to siphon any and all funds approved to the Conduit of all RWAs by impersonating a strategy token, rendering this exhibit to be of critical severity.

Example:

Copy
91/**
92 * @notice Check if a token is a tRWA token
93 * @param token Address of the token
94 * @return bool True if the token is a tRWA token, false otherwise
95 */
96function isStrategyToken(address token) external view override returns (bool) {
97    ItRWA tokenContract = ItRWA(token);
98    address strategy = address(tokenContract.strategy());
99
100    return isStrategy[strategy];
101}

Recommendation:

We advise bilateral validation to be performed, ensuring that the IStrategy::sToken value matches the token input to guarantee that the strategy yielded by the token indeed utilizes it.

Alleviation (e4d6885477438291b0d3ca477fab7e088522967b):

The code was updated to ensure bilateral validation of the input token, validating that the token's reported strategy is part of the system and that the strategy itself points to the token in question.