First Flight #15: Mondrian Wallet

Summary

The MondrianWallet::_validateSignature function should validate the signature. But the function returns always success whether the signature is valid or not.

Vulnerability Details

The goal of the internal function MondrianWallet::_validateSignature is to validate the signature provided by the user.

The problem is that this function always returns SIG_VALIDATION_SUCCESS. The function doesn't check the return value from the ECDSA.recover(hash, userOp.signature);. That means if the user doesn't have a valid signature, the function will return SIG_VALIDATION_SUCCESS.

Impact

The MondrianWallet::_validateSignature function is called in the MondrianWallet::validateUserOp to validate the signature of the user:

The validateUserOp function does not explicitly check the validationData returned by _validateSignature. The function assumes a successful signature validation by returning the value from _validateSignature without conditional verification.
Also, the MondrianWallet::_validateSignature returns always SIG_VALIDATION_SUCCESS due to the incorrect implementation. This function will return success whether the signature is valid or not. That means the user without valid signature can execute transactions without the required permission.

Tools Used

Manual Review

Recommendations

Add the following changes to the _validateSignature function in order to ensure the signature is valid and the user has permission to execute a given transaction: