Omisego Plasma MVP

Correct handling of exits is crucial for the overall security of Plasma chains. A malicious token contract may block all the subsequent exits for the given token by performing a DOS attack from within the function finalizeExits(). Exploit Scenario: 1. Add malicious token contract to RootChain.sol via the function addToken(). 2. finalizeExits() calls transfer() (line 297). 3. transfer() intentionally returns false. 4. finalizeExits() gets reverted undoing queue.delMin() (line 289).

The codebase relies on the clone-and-own approach for code reuse. The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of efort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain asecurity vulnerability, or may include intentionally or unintentionally modified upstream libraries. For example, although unused, the function copy() in RLP.sol has an incorrect implementation in line 203, where mload(dest) should be replaced by mload(src).

Gas usage is a main concern for smart contract developers and users, since high gas costs may prevent users from wanting to use the smart contract. Even worse, some gas usage issues may prevent the contract from providing services entirely.

Multiple functions are marked as constant. Furthermore checkSigs() in Validate.sol is marked as internal.

If currentFeeExit becomes large enough and there are 2^128 invocations of startFeeExit(), the fee exits UTXO position may clash with other exits (regular exists and deposit exists) since there is no validation that _utxoPos, should be less than 2^128. Otherwise, the bitwise OR in addExitToQueue() will afect the exitable_at value. Consequently, one can block the other exits. We consider this attack mostly theoretical since the number of required startFeeExit() invocations is impractically large.

Fees in the contract are implicit. The function startFeeExit() allows the operator to exit any amount they want, since the amount is specified as a parameter. The fees will be withdrawn from the same pool that holds users' funds. According to the specification, watchers must keep observing the contract to detect possible fraud and exit users’ funds.

Every Solidity file specifies in the header a version number of the format pragma solidity (^)0.4.*. The caret (^) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version and above, hence the term "unlocked."

Magic numbers, e.g., 1000000000 and 10000, are used across contracts.

The function checkSigs() uses assert to report post-validate oindex.

In the function finalizeExits(), the loop body (lines 287-307) allows the token transfer() call (line 297) to violate checks-efects-interactions pattern, which states that interactions with other contracts should happen at the very end of the function. Consequently transfer() may re-enter finalizeExits().