First Flight #19: Mondrian Wallet v2
First Flight #19
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`MondarinWallet2::_authorizeUpgrade` has no access control, allowing anyone to upgrade the contract.

4lifemen

Summary

The MondrianWallet2 contract has a critical vulnerability in the _authorizeUpgrade function. The lack of access control in this function allows any user to upgrade the smart contract to a malicious implementation, potentially compromising the contract's integrity and security.

Vulnerability Details

The _authorizeUpgrade function is designed to authorize upgrades to the contract's implementation. However, this function lacks access control, meaning it does not restrict who can call it. This allows any user to execute the upgradeToAndCall function and change the contract's implementation to a malicious contract.

// Needed for UUPS
function _authorizeUpgrade(address newImplementation) internal override {}

Proof of Concept

function testNotOwnerCanUpgrade() public {
address notOwner = makeAddr("notOwner");
​
MondrianWallet2 newImplementation = new MondrianWallet2();
​
vm.prank(notOwner);
mondrianWallet.upgradeToAndCall(address(newImplementation), "");
}

Test passed even though the upgradeToAndCall function wasn't called by the owner

Impact

The lack of access control in the _authorizeUpgrade function enables any user to upgrade the smart contract with malicious code. This vulnerability can lead to loss of funds thus compromising contract integrity.

Tools Used

  • Manual review

Recommendations

Implement access control for _authorizeUpgrade function

+ modifier requireFromOwner() {
+ if (msg.sender != owner()) {
+ revert MondrianWallet2__NotFromOwner();
+ }
+ _;
+ }
....
+ function _authorizeUpgrade(address newImplementation) internal override requireFromOwner {}
Updates

Lead Judging Commences

bube Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Lack of access control in _authorizeUpgrade

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.