Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Exclusion of implementation address in the signing data can lead to signature reuse in rare conditions

hash

Summary

The data signed by the organizer to distribute the funds doesn't include the implementation address of the contest. In case of two contests of an organizer with the same contest id this signature can be reused to distribute the prizes.

Vulnerability Details

The deployProxyAndDistributeBySignature() function uses the signature from the organizer to verify the distribution of prizes. The data fields covered by this signature are the contestid and data.

function deployProxyAndDistributeBySignature(
address organizer,
bytes32 contestId,
address implementation,
bytes calldata signature,
bytes calldata data
) public returns (address) {
bytes32 digest = _hashTypedDataV4(keccak256(abi.encode(contestId, data)));
if (ECDSA.recover(digest, signature) != organizer) revert ProxyFactory__InvalidSignature();
bytes32 salt = _calculateSalt(organizer, contestId, implementation);
if (saltToCloseTime[salt] == 0) revert ProxyFactory__ContestIsNotRegistered();
if (saltToCloseTime[salt] > block.timestamp) revert ProxyFactory__ContestIsNotClosed();
address proxy = _deployProxy(organizer, contestId, implementation);
_distribute(proxy, data);
return proxy;
}

The contract uniquely identifies a contest with the tuple (organizer, contestid , implementation ). Hence it is possible for two contests with the same (organizer,contestid) pair and different implementation addresses (although this wouldn't be occurring under normal conditions). If two such contests are present and the organizer uses their signature to distribute the prizes for one of the contest, this same signature can be used by an attacker (a person who has received a prize in the first contest will be incentivized to do so) to distribute the prizes of the other contest also.

Impact

Unintended distribution of prizes can occur in very rare conditions.

Tools Used

Manual Review

Recommendations

Include the implementation address in the signature

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.