当重试、重试、再重试导致乱序执行漏洞 - The Trail of Bits博客

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

/**
 * @notice 在L2收件箱中放入一条消息，如果回退，可以在固定时间内重新执行
 * @dev 所有msg.value将存入L2上的callValueRefundAddress
 * @dev 不应将gasLimit和maxFeePerGas设置为1，因为那会触发RetryableData错误
 * @param to 目标L2合约地址
 * @param l2CallValue 可重试L2消息的调用值
 * @param maxSubmissionCost 从用户L2余额中扣除的最大gas，用于支付基础提交费用
 * @param excessFeeRefundAddress gasLimit x maxFeePerGas - 执行成本将计入此地址的L2余额
 * @param callValueRefundAddress 如果可重试交易超时或取消，l2Callvalue将计入此地址的L2余额
 * @param gasLimit 从用户L2余额中扣除的最大gas，用于支付L2执行。不应设置为1（用于触发RetryableData错误的魔法值）
 * @param maxFeePerGas L2执行的价格出价。不应设置为1（用于触发RetryableData错误的魔法值）
 * @param data L2消息的ABI编码数据
 * @return 可重试交易的唯一消息编号
 */
function createRetryableTicket(
    address to,
    uint256 l2CallValue,
    uint256 maxSubmissionCost,
    address excessFeeRefundAddress,
    address callValueRefundAddress,
    uint256 gasLimit,
    uint256 maxFeePerGas,
    bytes calldata data
) external payable returns (uint256);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

function claim_rewards(address user) public onlyFromL1 {
    // 奖励基于余额和质押期计算
    uint unclaimed_rewards = _compute_and_update_rewards(user);
    token.safeTransfer(user, unclaimed_rewards);
}

// 在取消质押之前调用claim_rewards，否则你将失去奖励
function unstake(address user) public onlyFromL1 {
    _free_rewards(user); // 清理奖励相关变量
    balance = balance[user];
    balance[user] = 0;
    staked_token.safeTransfer(user, balance);
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

// 可重试A
IInbox(inbox).createRetryableTicket({
    to: l2contract,
    l2CallValue: 0,
    maxSubmissionCost: maxSubmissionCost,
    excessFeeRefundAddress: msg.sender,
    callValueRefundAddress: msg.sender,
    gasLimit: gasLimit,
    maxFeePerGas: maxFeePerGas,
    data: abi.encodeCall(l2contract.claim_rewards, (msg.sender))
});
// 可重试B
IInbox(inbox).createRetryableTicket({
    to: l2contract,
    l2CallValue: 0,
    maxSubmissionCost: maxSubmissionCost,
    excessFeeRefundAddress: msg.sender,
    callValueRefundAddress: msg.sender,
    gasLimit: gasLimit,
    maxFeePerGas: maxFeePerGas,
    data: abi.encodeCall(l2contract.unstake, (msg.sender))
});

1
2
3
4
5

Multiple retryable tickets created in the same function:
         -IInbox(inbox).createRetryableTicket({to:address(l2contract),l2CallValue:0,maxSubmissionCost:maxSubmissionCost,excessFeeRefundAddress:msg.sender,callValueRefundAddress:msg.sender,gasLimit:gasLimit,maxFeePerGas:maxFeePerGas,data:abi.encodeCall(l2contract.claim_rewards,(msg.sender))}) (out_of_order_retryable.sol#25-34)
         -IInbox(inbox).createRetryableTicket({to:address(l2contract),l2CallValue:0,maxSubmissionCost:maxSubmissionCost,excessFeeRefundAddress:msg.sender,callValueRefundAddress:msg.sender,gasLimit:gasLimit,maxFeePerGas:maxFeePerGas,data:abi.encodeCall(l2contract.unstake,(msg.sender))}) (out_of_order_retryable.sol#36-45)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#out-of-order-retryable-transactions
INFO:Slither:out_of_order_retryable.sol analyzed (3 contracts with 1 detectors), 1 result(s) found