First Flight #15: Mondrian Wallet
First Flight #15
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unchecked output of ECDSA.recover in _validateSignature

josh4324

Summary

The unchecked output of ECDSA.recover in the _validateSignature function of the MondrianWallet smart contract poses a severe security risk, potentially leading to unauthorized access to users' accounts. This vulnerability allows attackers to bypass signature verification, enabling them to execute unauthorized transactions.

Vulnerability Details

The vulnerability lies in the _validateSignature function, where the output of the ECDSA.recover operation is not properly validated. This oversight allows attackers to provide arbitrary signatures that may result in the validation of invalid or unauthorized transactions.

function _validateSignature(PackedUserOperation calldata userOp, bytes32 userOpHash)
internal
pure
returns (uint256 validationData)
{
bytes32 hash = MessageHashUtils.toEthSignedMessageHash(userOpHash);
@> ECDSA.recover(hash, userOp.signature);
return SIG_VALIDATION_SUCCESS;
}

Impact

This vulnerability could lead to unauthorized access to users' smart contract accounts, enabling attackers to execute arbitrary transactions, steal funds, or manipulate sensitive data. This can result in financial losses.

Tools Used

Manual Review

Recommendations

Implement Proper Signature Validation: Ensure that the output of the ECDSA.recover operation is properly validated before proceeding with transaction execution.

function _validateSignature(PackedUserOperation calldata userOp, bytes32 userOpHash)
internal
pure
returns (uint256 validationData)
{
bytes32 hash = MessageHashUtils.toEthSignedMessageHash(userOpHash);
- ECDSA.recover(hash, userOp.signature);
+ address recovered = ECDSA.recover(hash, userOp.signature);
- return SIG_VALIDATION_SUCCESS;
+ return owner() == recovered ? SIG_VALIDATION_SUCCESS : SIG_VALIDATION_FAILED;
}
​
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

ECDSA.recover should check against sender

`_validateSignature` SHOULD return SIG_VALIDATION_FAILED (and not revert) on signature mismatch.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.