Submission Details
Severity:
`MondrianWallet2::_executeTransaction(Transaction)` (src/MondrianWallet2.sol#149-164) sends eth to arbitrary user allowing for the contract to be manipulated
Summary
Unprotected call to _executeTransaction function by sending Ether to an arbitrary address.
Vulnerability Details
Dangerous calls:
- (success,None) = to.call{value: value}(data) (src/MondrianWallet2.sol#159)
Impact
The unprotected call allows for the contract to be manipulated through MondrianWallet2.executeTransaction(bytes32,bytes32,Transaction) (src/MondrianWallet2.sol#88-94).
Tools Used
Slither
Recommendations
Ensure that an arbitrary user cannot withdraw unauthorized funds.
Rewards breakdown
nSLOC
105This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.