Medium, CVSS 6.0GoPublished
Vega's validators able to submit duplicate transactions
CVE-2023-35163 · GHSA-8rc9-vxjh-qjf2
- Affected
- Go code.vegaprotocol.io/vega < 0.71.6
- Fixed in
- 0.71.6· Vendor fix available
- Issue
- A vulnerability exists that allows a malicious validator to trick the Vega network into re-processing past Ethereum events from Vega’s Ethereum bridge. For example, a deposit to the collateral bridge for 100USDT that credits a party’s general account on Vega, can be re-processed 50 times resulting in 5000USDT in that party’s general account. This is without depositing any more than the original 100USDT on the bridge. Despite this exploit requiring access to a validator's Vega key, a validator key can be obtained at the small cost of 3000VEGA, the amount needed to announce a new node onto the network. The steps to carry out this exploit are as follows: 1. Cause an Ethereum event on one of the bridge contracts e.g a deposit to the collateral bridge, or the staking bridge 2. This will result in the Ethereum-event-forwarder of each node to submit a ChainEvent transaction to the Vega network corresponding to that event 3. Scrape the valid chain event transaction from the Tendermint block…
Recommended action: Upgrade to 0.71.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.