⚡ Thor vs The Bifrost - DoS Case Study#

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
/*
5
   The BifrostBridge pays Asgardians their Ether by looping through all citizens.
6
   Loki can jam the bridge by reverting in his fallback, blocking ALL payouts.
7
*/
8

9
contract BifrostBridgeVulnerable {
10
    address[] public asgardians;
11
    mapping(address => uint256) public vaultOfAsgard;
12

13
    /// @notice Asgardians send their Ether to the Bifrost
14
    function enterBifrost(address realmWalker) external payable {
15
        require(msg.value > 0, "Bifrost requires Ether toll");
16
        if (vaultOfAsgard[realmWalker] == 0) {
17
            asgardians.push(realmWalker);
18
        }
19
        vaultOfAsgard[realmWalker] += msg.value;
20
    }
21

22
    /// @notice Heimdall distributes Ether to all Asgardians (⚠️ Vulnerable)
23
    function openBifrost() external {
24
        for (uint256 i = 0; i < asgardians.length; i++) {
25
            address traveler = asgardians[i];
26
            uint256 tribute = vaultOfAsgard[traveler];
27
            if (tribute > 0) {
28
                //  Loki can revert here and jam the bridge
29
                (bool sent, ) = payable(traveler).call{value: tribute}("");
30
                require(sent, "Bifrost jammed!");
31
                vaultOfAsgard[traveler] = 0;
32
            }
33
        }
34
    }
35
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
/// @title Loki jams the Bifrost by reverting on receive
5
contract LokiTrickster {
6
    receive() external payable {
7
        revert("Loki jams the Bifrost!");
8
    }
9
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4
/// @title Safe Bifrost with resilient withdrawals
5
contract BifrostBridgeFixed {
6
    mapping(address => uint256) public vaultOfAsgard;
7

8
    /// @notice Deposit Ether to Bifrost
9
    function enterBifrost() external payable {
10
        require(msg.value > 0, "Bifrost requires Ether toll");
11
        vaultOfAsgard[msg.sender] += msg.value;
12
    }
13

14
    /// @notice Withdraw Ether safely, preserving vault on failure
15
    function crossBifrostSafe() external {
16
        uint256 tribute = vaultOfAsgard[msg.sender];
17
        require(tribute > 0, "No tribute to cross");
18

19
        vaultOfAsgard[msg.sender] = 0;
20

21
        (bool sent, ) = payable(msg.sender).call{value: tribute}("");
22
        if (!sent) {
23
            // Restore balance so user can retry
24
            vaultOfAsgard[msg.sender] = tribute;
25
        }
26
    }
27
}

1
// SPDX-License-Identifier: MIT
2
pragma solidity ^0.8.24;
3

4 collapsed lines
4
import {Test} from "forge-std/Test.sol";
5
import {BifrostBridgeVulnerable} from "../src/BifrostBridgeVulnerable.sol";
6
import {BifrostBridgeFixed} from "../src/BifrostBridgeFixed.sol";
7
import {LokiTrickster} from "../src/LokiTrickster.sol";
8

9
contract DoSBifrostTest is Test {
10
    BifrostBridgeVulnerable bifrostVuln;
11
    BifrostBridgeFixed bifrostSafe;
12
    LokiTrickster loki;
13
    address thor = makeAddr("Thor");
14

15
    function setUp() public {
16
        // Deploy contracts
17
        bifrostVuln = new BifrostBridgeVulnerable();
18
        bifrostSafe = new BifrostBridgeFixed();
19
        loki = new LokiTrickster();
20

21
        // Fund users
22
        vm.deal(thor, 1 ether);
23
        vm.deal(address(loki), 1 ether);
24

25
        // Deposit into vulnerable contract
26
        bifrostVuln.enterBifrost{value: 1 ether}(thor);
27
        bifrostVuln.enterBifrost{value: 1 ether}(address(loki));
28
    }
29

30
    function test_BifrostJammedByLoki() public {
31
        // Expect revert because Loki reverts in openBifrost
32
        vm.expectRevert();
33
        bifrostVuln.openBifrost();
34
    }
35

36
    function test_ThorCrossesSafeBifrost() public {
37
        vm.prank(thor);
38
        bifrostSafe.enterBifrost{value: 1 ether}();
39

40
        uint256 beforeBalance = thor.balance;
41
        uint256 beforeVault = bifrostSafe.vaultOfAsgard(thor);
42

43
        vm.prank(thor);
44
        bifrostSafe.crossBifrostSafe();
45

46
        // Assert Thor received funds
47
        assertEq(address(thor).balance, beforeBalance + beforeVault);
48
        // Assert vault cleared
49
        assertEq(bifrostSafe.vaultOfAsgard(thor), 0);
50
    }
51

52
    function test_LokiCannotBlockThor() public {
53
        // Loki enters safe contract
54
        vm.prank(address(loki));
55
        bifrostSafe.enterBifrost{value: 1 ether}();
56

57
        // Loki tries to withdraw but reverts internally (simulated in crossBifrostSafe)
58
        vm.prank(address(loki));
59
        bifrostSafe.crossBifrostSafe();
60

61
        // Thor enters and withdraws safely
62
        vm.prank(thor);
63
        bifrostSafe.enterBifrost{value: 1 ether}();
64

65
        vm.prank(thor);
66
        bifrostSafe.crossBifrostSafe();
67

68
        // Assert Thor successfully received funds
69
        assertEq(address(thor).balance, 1 ether);
70
        assertEq(bifrostSafe.vaultOfAsgard(thor), 0);
71
    }
72

73
    function test_MultipleUsersSafeWithdrawal() public {
74
        address lokiUser = makeAddr("LokiUser");
75
        address jane = makeAddr("Jane");
76

77
        vm.deal(lokiUser, 1 ether);
78
        vm.deal(jane, 1 ether);
79

80
        // Deposits
81
        vm.prank(thor);
82
        bifrostSafe.enterBifrost{value: 0.5 ether}();
83
        vm.prank(jane);
84
        bifrostSafe.enterBifrost{value: 0.3 ether}();
85
        vm.prank(lokiUser);
86
        bifrostSafe.enterBifrost{value: 0.2 ether}();
87

88
        // Withdrawals
89
        vm.prank(thor);
90
        bifrostSafe.crossBifrostSafe();
91
        vm.prank(jane);
92
        bifrostSafe.crossBifrostSafe();
93
        vm.prank(lokiUser);
94
        bifrostSafe.crossBifrostSafe();
95

96
        // Assert vaults cleared
97
        assertEq(bifrostSafe.vaultOfAsgard(thor), 0);
98
        assertEq(bifrostSafe.vaultOfAsgard(jane), 0);
99
        assertEq(bifrostSafe.vaultOfAsgard(lokiUser), 0);
100

101
        // Assert balances
102
        assertEq(address(thor).balance, 1 ether );
103
        assertEq(address(jane).balance, 1 ether );
104
        assertEq(address(lokiUser).balance, 1 ether );
105
    }
106

107
    function test_CannotWithdrawWithoutDeposit() public {
108
        vm.expectRevert("No tribute to cross");
109
        bifrostSafe.crossBifrostSafe();
110
    }
111
}