Submission Details
Severity:
Users can front run the signature of the userOp, leading to some problems
Summary
Users can front run the signature of the userOp, leading to some problems
Vulnerability Details
When user want to call validateUserOp function by calling entrypoint .
This contract will validate user's parameter .
function _validateSignature(PackedUserOperation calldata userOp, bytes32 userOpHash)
internal
pure
returns (uint256 validationData)
{
bytes32 hash = MessageHashUtils.toEthSignedMessageHash(userOpHash);
ECDSA.recover(hash, userOp.signature);
return SIG_VALIDATION_SUCCESS;
}
This problem is that _validateSignature may be used in mempool, a malicious user can front-run this signature , to complete this tranaction before user's tranaction .
Impact
After this signature is used once by malicious user, this user might loss his fund .
Tools Used
Mannual Review , Foundry
Recommendations
Consider add more parameter (msg.sender) , to this calldata userOp
Rewards breakdown
nSLOC
89This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.