First Flight #19: Mondrian Wallet v2

Summary

The _authorizeUpgradefunction is vulnerable to manipulation by blackhat aggressors, and gives them control over the contract.

Vulnerability Details

This function is needed for proper UUPS implementation:

However, it is callable by anyone. Therefore, an attacker can call this function to unlawfully create a new implementation.

Here is a PoC:

• an attacker wants to take over the wallet

• the attacker passes a new address to the _authorizeUpgradefunction

• the contract is successfully upgraded to the new address

• the attacker is in charge!

Impact

Possible hijack of the wallet control.

Tools Used

Manual review.

Recommendations

Make the function only callable by the admin.