First Flight #15: Mondrian Wallet

Summary

There is no validation check of Userops executed through the execute function if is called by entrypoint.

Vulnerability Details

Due to missing validation check of validationdata in the execute function some not valid userOps can be executed.

Impact

If too much time has passed between the validation made by the entrypoint through validateUserOp and the time when the function execute is called some userOps may still not be valid, but they are executed anyway.

Tools Used

Manual review

Recommendations

Add in execute function a check of validationdata