Submission Details
Severity:
Function must be delegated to selected address
Summary
Vulnerability Details
Use of a signature to verify the deployment of proxy & rewards distribution might be frontrun by a malicious attacker since there is no data regarding who can use the signature to execute the function.
Frontrunner can copy all the data and replace the reward data into one which transfers it all to the attackers' wallet.
Impact
Loss of the entire reward pool set by the contest sponsor.
Tools Used
Manual Review
Recommendations
Set a message hash as such so that it uses delegated address and verify it in the deployProxyAndDistributeBySignature function
function deployProxyAndDistributeBySignature(
address organizer,
bytes32 contestId,
address delegatedTo,
address implementation,
bytes calldata signature,
bytes calldata data
) public returns (address) {
bytes32 digest = _hashTypedDataV4(
keccak256(abi.encode(contestId, delegatedTo, data))
);
if(delegatedTo != msg.sender)
revert ProxyFatory__Unauthorized();
// rest of the code ....
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.