AssertionStakingPoolCreator.getPool() is vulnerable to address collission

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2024-05-arbitrum-foundation/blob/6f861c85b281a29f04daacfe17a2099d7dad5f8f/src/assertionStakingPool/StakingPoolCreatorUtils.sol#L13

Vulnerability details

Summary

Using computed pool addresses to get pool address is prone to collision attack. StakingPoolCreatorUtils.sol never verifies that the pool is actually a deployed pool by createPool(). This allows for a provable address collision that can be used to drain all allowances to the router.

Proof of Concept

When creating new pools _assertionHash is the only user-defined value, because address _rollup will always be the same. If attacker will compute the value of
_assertionHash, he will be able to drain all protocol allowances, user interacting with pool often sets allowance to uint.max.

function createPool(
        address _rollup,
        bytes32 _assertionHash
    ) external returns (IAssertionStakingPool) {
        AssertionStakingPool assertionPool = new AssertionStakingPool{salt: 0}(_rollup, _assertionHash);
        emit NewAssertionPoolCreated(_rollup, _assertionHash, address(assertionPool));
        return assertionPool;
    }

A primer on hash collision probability can be found here (https://kevingal.com/blog/collisions.html).

With the advancement of computing hardware, the cost of an attack has been shown to be just a few million dollars, and that the current Bitcoin network hashrate allows about 2^80 in about half an hour. The cost of the attack may be offsetted with longer brute force time.

The address collision an attacker will need to find are:

• One undeployed staking pool contract address (1).
• Arbitrary attacker-controlled wallet contract (2).

For more information, see similar reports:
sherlock-audit/2023-07-kyber-swap-judging#90
sherlock-audit/2024-01-napier-judging#111
sherlock-audit/2023-12-arcadia-judging#59

Impact

Complete draining of a staking pool if an address collision is found.

Tools Used

Manual review.

Recommended Mitigation Steps

Do not use Create2.computeAddress(). Instead create a function that verifies that a pool address has been deployed by AssertionStakingPoolCreator.createPool() using the _pools mapping.

Assessed type

Invalid Validation