First Flight #15: Mondrian Wallet

Summary

The requireFromEntryPointOrOwner modifier in the MondrianWallet smart contract is currently implemented with a logical error that might inadvertently restrict access more than intended. The modifier is designed to restrict certain functions to be callable only by either the designated entry point or the contract owner. However, due to an incorrect use of the logical AND (&&) operator, the modifier's condition may not function as intended if interpreted to allow either condition independently.

Vulnerability Details

The current implementation uses an AND conjunction where an OR should have been used, leading to a logical flaw. The modifier mistakenly requires both conditions (not being the owner and not being the entry point) to be true simultaneously to trigger a revert, which is a misconfiguration of the intended access control logic. Here is the current code:

This code should allow either the entry point or the owner to execute the function, but the use of && incorrectly aligns the logic to require both to be false to trigger the revert.

Impact

This logical error could lead to confusion or incorrect assumptions about who can call the modified functions, potentially restricting access more than intended. While this does not directly impact the security or operational integrity of the contract, it could lead to administrative difficulties or misunderstandings during implementation or operational phases.

Tools Used

*Manual Review

Recommendations

1. Correct the Logical Operator: Change the logical AND operator (&&) to an OR operator (||) to correctly implement the intended functionality of allowing either the entry point or the owner to proceed. The corrected modifier should look like this:

   modifier requireFromEntryPointOrOwner() {

   if (msg.sender != address(i_entryPoint) || msg.sender != owner()) {

   revert MondrianWallet__NotFromEntryPointOrOwner();

   }

   _;

   }