First Flight #19: Mondrian Wallet v2

Summary

The initializefunction is vulnerable as an attacker can outsmart the wallet admin and initialize the contract before they do.

Vulnerability Details

Here is the vulnerable function:

This is an implementation of Open Zeppelin to properly initialize the implementation contract. However, the dev did not contextualize the function to the current contract.

As it is now, anyone who calls this function will be the owner, which is dangerous before a malicious entity can do this.

Here is a PoC:

• wallet admins deploy the contract

• attacker calls the initializefunction before the rightful owners do

• attacker is in charge of the contract as the owner - albeit an unlawful one

Impact

Hijacking of the wallet.

Tools Used

Manual review.

Recommendations

Make it callable by only the admins of the wallet.