当重试、重试、再重试导致乱序执行漏洞 - The Trail of Bits Blog

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

/**
 * @notice 在 L2 收件箱中放置一条消息，如果它回退，可以在固定时间内重新执行
 * @dev 所有 msg.value 将存入 L2 的 callValueRefundAddress
 * @dev 不应将 Gas 限制和 maxFeePerGas 设置为 1，因为那用于触发 RetryableData 错误
 * @param to 目标 L2 合约地址
 * @param l2CallValue 可重试 L2 消息的调用值
 * @param maxSubmissionCost 从用户 L2 余额中扣除的最大 Gas，以覆盖基础提交费用
 * @param excessFeeRefundAddress gasLimit x maxFeePerGas - 执行成本将记入此地址的 L2 余额
 * @param callValueRefundAddress 如果可重试交易超时或取消，l2Callvalue 将记入此地址的 L2
 * @param gasLimit 从用户 L2 余额中扣除的最大 Gas，以覆盖 L2 执行。不应设置为 1（用于触发 RetryableData 错误的魔法值）
 * @param maxFeePerGas L2 执行的价格出价。不应设置为 1（用于触发 RetryableData 错误的魔法值）
 * @param data L2 消息的 ABI 编码数据
 * @return 可重试交易的唯一消息编号
 */
function createRetryableTicket(
    address to,
    uint256 l2CallValue,
    uint256 maxSubmissionCost,
    address excessFeeRefundAddress,
    address callValueRefundAddress,
    uint256 gasLimit,
    uint256 maxFeePerGas,
    bytes calldata data
) external payable returns (uint256);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

function claim_rewards(address user) public onlyFromL1 {
    // 奖励基于余额和质押期计算
    uint unclaimed_rewards = _compute_and_update_rewards(user);
    token.safeTransfer(user, unclaimed_rewards);
}

// 在取消质押前调用 claim_rewards，否则您将失去奖励
function unstake(address user) public onlyFromL1 {
    _free_rewards(user); // 清理奖励相关变量
    balance = balance[user];
    balance[user] = 0;
    staked_token.safeTransfer(user, balance);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

// 可重试 A
IInbox(inbox).createRetryableTicket({
    to: l2contract,
    l2CallValue: 0,
    maxSubmissionCost: maxSubmissionCost,
    excessFeeRefundAddress: msg.sender,
    callValueRefundAddress: msg.sender,
    gasLimit: gasLimit,
    maxFeePerGas: maxFeePerGas,
    data: abi.encodeCall(l2contract.claim_rewards, (msg.sender))
});
// 可重试 B
IInbox(inbox).createRetryableTicket({
    to: l2contract,
    l2CallValue: 0,
    maxSubmissionCost: maxSubmissionCost,
    excessFeeRefundAddress: msg.sender,
    callValueRefundAddress: msg.sender,
    gasLimit: gasLimit,
    maxFeePerGas: maxFeePerGas,
    data: abi.encodeCall(l2contract.unstake, (msg.sender))
});

1
2
3
4
5

Multiple retryable tickets created in the same function:
         -IInbox(inbox).createRetryableTicket({to:address(l2contract),l2CallValue:0,maxSubmissionCost:maxSubmissionCost,excessFeeRefundAddress:msg.sender,callValueRefundAddress:msg.sender,gasLimit:gasLimit,maxFeePerGas:maxFeePerGas,data:abi.encodeCall(l2contract.claim_rewards,(msg.sender))}) (out_of_order_retryable.sol#25-34)
         -IInbox(inbox).createRetryableTicket({to:address(l2contract),l2CallValue:0,maxSubmissionCost:maxSubmissionCost,excessFeeRefundAddress:msg.sender,callValueRefundAddress:msg.sender,gasLimit:gasLimit,maxFeePerGas:maxFeePerGas,data:abi.encodeCall(l2contract.unstake,(msg.sender))}) (out_of_order_retryable.sol#36-45)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#out-of-order-retryable-transactions
INFO:Slither:out_of_order_retryable.sol analyzed (3 contracts with 1 detectors), 1 result(s) found