First Flight #15: Mondrian Wallet

Summary

validateNonce function is either not complete or does not actually do anything unlike what the doc says

Vulnerability Details

function validateUserOp(PackedUserOperation calldata userOp, bytes32 userOpHash, uint256 missingAccountFunds)
    external
    virtual
    override
    requireFromEntryPoint
    returns (uint256 validationData)
{
    validationData = _validateSignature(userOp, userOpHash);
    _validateNonce(userOp.nonce);
    _payPrefund(missingAccountFunds); 
}

validateNonce is done here but if we look at
function _validateNonce(uint256 nonce) internal view virtual {} it does nothing at all

Impact

Nonce is not validated which makes it vulnerable to signature replay attacks

Tools Used

Manual Review

Recommendations

Make sure validateNonce actually validate nonce.