First Flight #15: Mondrian Wallet

Summary

The execute function performs an external call to the specified dest address with a specified value and calldata. External calls can potentially open the contract to reentrancy attacks, where an attacker can recursively call the execute function before the initial execution completes, manipulating the contract's state in unexpected ways.

Vulnerability Details

A reentrancy attack can occur if the external contract called by execute makes a callback into the MondrianWallet contract. If the contract state is not properly managed, this can lead to vulnerabilities, including draining funds or corrupting the contract state.

Impact

Impact: Medium. Severity: High

Tools Used

Manual review

Recommendations

To mitigate the risk of reentrancy attacks, use the ReentrancyGuard contract from OpenZeppelin. This contract provides a nonReentrant modifier that can be applied to functions to prevent them from being called recursively.