Submission Details
Severity:
The bridged NFT will be lost for the users using account abstraction
Summary
All users using account abstraction wallets will not be able to bridge their NFT from one chain to another. This because they have different addresses across chain for the same account and therefore, all the NFTs will be bridged to a wrong address and lost forever
Vulnerability Details
The modifier onlyAllowlisted uses msg.sender as the address of the sender but this is not true when using account abstraction wallets
function _ccipReceive(Client.Any2EVMMessage memory any2EvmMessage)
internal
override
onlyAllowlisted(any2EvmMessage.sourceChainSelector, msg.sender)
{
KittyConnect(kittyConnect).mintBridgedNFT(any2EvmMessage.data);
emit MessageReceived(
any2EvmMessage.messageId,
any2EvmMessage.sourceChainSelector,
abi.decode(any2EvmMessage.sender, (address)),
any2EvmMessage.data
);
}
Impact
For all account abstraction wallet users, all the NFTs will be bridged to a wrong address and lost forever
Tools Used
Manual review
Recommendations
Recommendations
Give the users the option to pass in the sender address
- function _ccipReceive(Client.Any2EVMMessage memory any2EvmMessage)
+ function _ccipReceive(Client.Any2EVMMessage memory any2EvmMessage, address sender)
internal
override
- onlyAllowlisted(any2EvmMessage.sourceChainSelector, msg.sender)
+ onlyAllowlisted(any2EvmMessage.sourceChainSelector, sender)
{
KittyConnect(kittyConnect).mintBridgedNFT(any2EvmMessage.data);
emit MessageReceived(
any2EvmMessage.messageId,
any2EvmMessage.sourceChainSelector,
abi.decode(any2EvmMessage.sender, (address)),
any2EvmMessage.data
);
}
Updates
Lead Judging Commences
inallhonesty
about 1 year ago
inallhonesty about 1 year ago
Submission Judgement Published Assigned finding tags:
Account abstraction
Rewards breakdown
nSLOC
235This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.