batchTransferOutV5 could emit multiple TransferOut events, but Bifrost Observation can handle only one per transaction.

[c4-bot-4]

Lines of code

https://github.com/code-423n4/2024-06-thorchain/blob/e5ae503d0dc2394a82242be6860eb538345152a1/ethereum/contracts/THORChain_Router.sol#L247-L253
https://github.com/code-423n4/2024-06-thorchain/blob/e5ae503d0dc2394a82242be6860eb538345152a1/ethereum/contracts/THORChain_Router.sol#L209-L238
https://github.com/code-423n4/2024-06-thorchain/blob/e5ae503d0dc2394a82242be6860eb538345152a1/bifrost/pkg/chainclients/shared/evm/smartcontract_log_parser.go#L166-L343

Vulnerability details

Impact

The batchTransferOutV5 function is the batch version of the transferOutV5 function. When provided with an array of TransferOutData, the batchTransferOutV5 function can emit multiple TransferOut events in one transaction.

However, in the GetTxInItem function in smartcontract_log_parser.go, if there are multiple transferOutEvents in the logs array, the information in txInItem is overwritten during the iteration of the last transferOutEvent. Consequently, only the last transferOutEvent is logged by Bifrost (its txInItem populated by GetTxInItem), and all previous ones are ignored.

As a result, when a THORChain vault uses batchTransferOutV5, their allowance could be spent without the THORChain network acknowledging the outbound from the vault, leading to a loss of funds for the THORChain vault.

Tools Used

Manual Review

Recommended Mitigation Steps

Modify the event logging logic in smartcontract_log_parser.go to accommodate the use of batchTransferOutV5.

Assessed type

Error