Submission Details
Severity:
Lack of access control in `payForTransaction`
Description: The payForTransaction function lacks access control, allowing anyone to potentially pay for transactions on behalf of the wallet.
Impact:
An attacker notices a pending transaction from the wallet.
The attacker calls payForTransaction with a high gas price, front-running the original transaction.
This could lead to unexpected behavior or potential manipulation of transaction ordering.
Recommended Mitigation:
Add access control to the function
function payForTransaction(bytes32, bytes32, Transaction memory _transaction) external payable onlyOwner {
bool success = _transaction.payToTheBootloader();
if (!success) {
revert MondrianWallet2__FailedToPay();
}
}
Updates
Lead Judging Commences
bube 12 months ago
Submission Judgement Published Assigned finding tags:
Lack of access control in payForTransaction function
Rewards breakdown
nSLOC
105This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.