First Flight #19: Mondrian Wallet v2
First Flight #19
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Logic Flaw in `MondarinWallet2::executeTransactionFromOutside`: Function Continues Execution Despite Failed Validation, hence anyone can call and executeTransaction

4lifemen

Summary

The executeTransactionFromOutside function in the MondrianWallet2 contract does not properly revert when transaction validation fails. It executes the transaction regardless of the validation result, which can lead to unauthorized actions from the wallet.

Vulnerability Details

function executeTransactionFromOutside(Transaction memory _transaction) external payable {
_validateTransaction(_transaction);
_executeTransaction(_transaction);
}

Proof of Concept

function testZkExcuteTransactionFromOutside() public onlyZkSync {
address dest = address(usdc);
uint256 value = 0;
bytes memory functionData = abi.encodeWithSelector(ERC20Mock.mint.selector, address(mondrianWallet), AMOUNT);
Transaction memory transaction =
_createUnsignedTransaction(address(mondrianWallet), 113, dest, value, functionData);
​
transaction = _signTransaction(transaction);
vm.prank(BOOTLOADER_FORMAL_ADDRESS);
mondrianWallet.executeTransactionFromOutside(transaction);
​
assertEq(usdc.balanceOf(address(mondrianWallet)), AMOUNT);
}
​
function _signTransaction(Transaction memory transaction) internal returns (Transaction memory) {
bytes32 unsignedTransactionHash = MemoryTransactionHelper.encodeHash(transaction);
// Creating not owner address and private key
(, uint256 privateKey) = makeAddrAndKey("notOwner");
uint8 v;
bytes32 r;
bytes32 s;
// Generate signature with not owner address
(v, r, s) = vm.sign(privateKey, unsignedTransactionHash);
Transaction memory signedTransaction = transaction;
signedTransaction.signature = abi.encodePacked(r, s, v);
return signedTransaction;
}

Impact

Unauthorized Access: Anyone can execute transactions without providing a valid signature. This undermines the integrity of the account abstraction model, where transactions should only be authorized by the account owner.

Tools Used

  • Manual review

Recommendations

Ensures that the executeTransactionFromOutside function properly reverts if the `_validationTransaction fails.

function executeTransactionFromOutside(Transaction memory _transaction) external payable {
- _validateTransaction(_transaction);
+ bytes4 magic = _validateTransaction(_transaction);
+ if (magic != ACCOUNT_VALIDATION_SUCCESS_MAGIC) {
+ revert MondrianWallet2__InvalidSignature();
+ }
_executeTransaction(_transaction);
}
Updates

Lead Judging Commences

bube Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Missing validation in executeTransactionFromOutside

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.