First Flight #15: Mondrian Wallet
First Flight #15
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`MondrianWallet::_validateSignature` doesn't verifies signer to be only the owner allowing attackers to drain all the balance

shikhar229169

Summary

MondrianWallet::_validateSignature function is expected to verify that the signer of the signature is the owner of the contract but it has not implemented a check to verify that the signer of the txn is the owner which leads to _validateSignature always returning SIG_VALIDATION_SUCCESS and any transaction can be executed on behalf of the MondrianWallet and charges the fee from it which will thus drain the wallet.

Vulnerability Details

  • The vulnerability is present in the _validateSignature function where it doesn't verify that the signer of the txn being executed via the MondrianWallet is actually its owner.

  • It is actually a necessary check to ensure only transactions that are signed by the owner are to be executed other, but due to the missing check anyone can perform txn via the MondrianWallet and ultimately drain all the balance by passing their own arbitrary data which may include the instruction to transfer ETH or any token to their address in the userOps to be executed by execute function on MondrianWallet.

Impact

All the balance of MondrianWallet will get drained.

Tools Used

Manual Review

Recommendations

Add a check to only return SIG_VALIDATION_SUCCESS if the signer is the owner otherwise return SIG_VALIDATION_FAILED.

function _validateSignature(PackedUserOperation calldata userOp, bytes32 userOpHash)
internal
pure
returns (uint256 validationData)
{
bytes32 hash = MessageHashUtils.toEthSignedMessageHash(userOpHash);
if (owner() != ECDSA.recover(hash, userOp.signature)) return SIG_VALIDATION_FAILED;
return SIG_VALIDATION_SUCCESS;
}
Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

ECDSA.recover should check against sender

`_validateSignature` SHOULD return SIG_VALIDATION_FAILED (and not revert) on signature mismatch.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!