First Flight #19: Mondrian Wallet v2

Summary

The executeTransactionFromOutside function in the MondrianWallet2 contract does not properly validate the return value from the _validateTransaction function, which could lead to unauthorized transactions being executed.

Vulnerability Details

In the executeTransactionFromOutside function, the return value from the _validateTransaction function is not checked before executing the transaction. The _validateTransaction function is responsible for validating the transaction signature and ensuring that the transaction is authorized. If the validation fails, it should return a value other than ACCOUNT_VALIDATION_SUCCESS_MAGIC. However, the executeTransactionFromOutside function does not check for this condition, allowing potentially unauthorized transactions to be executed.

Impact

An attacker could execute unauthorized transactions on behalf of the MondrianWallet2 contract.

Tools Used

Manual review, docs

Recommendations

The executeTransactionFromOutside function should be modified to check the return value from the _validateTransaction function and revert if the validation fails.