First Flight #15: Mondrian Wallet
First Flight #15
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Risk of unchecked payment failures in `MondrianWallet::_payPrefund` can cause loss of funds for the `EntryPoint`

irondevx

Summary

MondrianWallet::_payPrefund does not handle failures when attempting to send ETH to the EntryPoint, potentially allowing malicious activities that could drain the its resources.

Vulnerability Details

MondrianWallet::_payPrefund is designed to send the required ETH to cover transaction costs to the EntryPoint and it currently sends these funds without checking the success of the transaction.

It is assumed that the EntryPoint is responsible for ensuring it receives the necessary funds, however, if the transfer fails and this is not checked or logged, the EntryPoint might proceed with transactions without having received the required funds, potentially leading to financial discrepancies or abuse where the EntryPoint incurs costs without compensation.

function _payPrefund(uint256 missingAccountFunds) internal virtual {
if (missingAccountFunds != 0) {
(bool success,) = payable(msg.sender).call{value: missingAccountFunds, gas: type(uint256).max}("");
@> (success); // ignore failure (its EntryPoint's job to verify, not account.)
}
}

Impact

Malicious actors could potentially exploit this by repeatedly causing transactions that fail to transfer ETH correctly, intentionally draining the EntryPoint's resources. Also, ignoring transfer failures could lead to situations where the EntryPoint executes transactions without receiving the necessary funding, which might result in losses or insufficient fund coverage for transaction fees.

Tools Used

Manual review

Recommendations

Check the success of the ETH transfer and handle failures appropriately:

function _payPrefund(uint256 missingAccountFunds) internal virtual {
if (missingAccountFunds != 0) {
(bool success,) = payable(msg.sender).call{value: missingAccountFunds, gas: type(uint256).max}("");
- (success);
+ require(success, "Failed to send ETH to EntryPoint");
}
}
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.