magmo/force-move-protocol

Public `conclude` method has no checks

Opened this issue · 0 comments

More accurately, the only check is that the channel is not already finalized.

It's therefore trivial to finalize a channel with any outcome I like, and thereby steal other participants' money.

function conclude(ConclusionProof memory proof) public {
_conclude(proof);
}

and

function _conclude(ConclusionProof memory proof) internal {
address channelId = proof.penultimateCommitment.channelId();
require(
(outcomes[channelId].finalizedAt > now || outcomes[channelId].finalizedAt == 0),
"Conclude: channel must not be finalized"
);
outcomes[channelId] = Outcome(
proof.penultimateCommitment.destination,
now,
proof.penultimateCommitment,
proof.penultimateCommitment.allocation
);
emit Concluded(channelId);
}