Submission Details
Severity:
The function validateTransaction does not check when validating the owner
Summary
The validation function does not check whether the user calling the contract is the owner or not.
Vulnerability Details
The vulnerability is that an attacker can indicate his Paymaster and assign the transaction to himself, line 4 is missing owner check. There is a need for BootLoader, an attacker can bypass the bootloader “check”
'''
function validateTransaction(bytes32, /*_txHash*/ bytes32, /*_suggestedSignedHash*/ Transaction memory _transaction)
external
payable
requireFromBootLoader
returns (bytes4 magic)
{
return _validateTransaction(_transaction);
}
'''
Impact
There may be gas manipulation due to the fact that the attacker has become the “master” and uses validation
Tools Used VSCode, GIT, Foundry, Searching in WEB about BootLoader
Recommendations "Add OrOwner"
Rewards breakdown
nSLOC
105This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.