First Flight #15: Mondrian Wallet
First Flight #15
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Inadequate signature validation in `MondrianWallet::_validateSignature`

irondevx

Summary

MondrianWallet::_validateSignature fails to verify the identity of the message signer.

Vulnerability Details

MondrianWallet::_validateSignature is responsible for validating the signatures of operations passed through the EntryPoint. Currently, the function only confirms that a signature is technically valid without verifying if it was signed by an authorized party (e.g., the wallet owner or another trusted signer).

// MondrianWallet.sol
function _validateSignature(PackedUserOperation calldata userOp, bytes32 userOpHash)
internal
pure
returns (uint256 validationData)
{
bytes32 hash = MessageHashUtils.toEthSignedMessageHash(userOpHash);
@> ECDSA.recover(hash, userOp.signature);
return SIG_VALIDATION_SUCCESS;
}

Impact

Failing to verify the signer allows any user who can craft a valid signature to pass signature checks, potentially leading to unauthorized actions being performed under the guise of valid operations via ``MondrianWallet::execute`, which is called in a future part of ERC-4337 transaction flow.

Tools Used

Manual review

Recommendations

Add a check within the MondrianWallet::_validateSignature function to ensure that the operation is authorized by verifying the signature against the owner of the wallet:

function _validateSignature(PackedUserOperation calldata userOp, bytes32 userOpHash)
internal
pure
returns (uint256 validationData)
{
bytes32 hash = MessageHashUtils.toEthSignedMessageHash(userOpHash);
- ECDSA.recover(hash, userOp.signature);
+ require(ECDSA.recover(hash, userOp.signature) == owner(), "Invalid signature");
return SIG_VALIDATION_SUCCESS;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

ECDSA.recover should check against sender

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.