First Flight #19: Mondrian Wallet v2
First Flight #19
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Unprotected UUPS:_authorizeUpgrade() allows anyone to change the implementation to a malicious one and steal user's funds

0xlrivo

Summary

Unprotected UUPS:_authorizeUpgrade() allows anyone to change the implementation to a malicious one and steal user's funds.

Vulnerability Details

The _authorizeUpgrade(), in the Openzeppelin UUPS implementation, is expected to be overriden by the child contract to enforce access control protection on upgradeToAndCall().

In MondrianWalletV2.sol the function is overridden but the onlyOwner modifier is missing, this allows anyone to call it and update the proxy implementation.

// @audit-issue missing onlyOwner modifier, anyone can update the implementation
function _authorizeUpgrade(address newImplementation) internal override {}

A malicious user can exploit this by changing the implementation to a malicious contract that he deployed which, for example, allows only the attacker to execute transactions on the wallet... effectively stealing the user's assets.

Tools Used

Manual review

Recommendations

Add the onlyOwner modifier to _authorizeUpgrade().

Updates

Lead Judging Commences

bube Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of access control in _authorizeUpgrade

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.