Summary

executeTransactionFromTheOutside does not check the outcome of signature verification. Consequently, any signed transaction can be executed through this function, not only those that were signed by the actual owner of the contract.

Vulnerability Details

executeTransactionFromTheOutside is a function that anyone can call to submit transactions for execution via the wallet. Importantly, only those submitted transactions are supposed to be executed that have been properly validated and have been signed by the owner of the wallet.

Transaction validation happens via a call to _validateTransaction which, among other things, performs signature verification and returns a bytes4 magic value that signifies the outcome of the signature verification. executeTransactionFromTheOutside, however, ignores this return value and proceeds to execute the submitted transaction irrespectively of the validity of the signature.

Essentially, any signed transactions will be executed even if the signature is not valid - provided of course, that they do not revert at other verification steps, like a balance check.

The following test demonstrates that a transaction signed with a dummy private key (i.e. not a valid signature, not a signature from the owner) will get executed by executeTransactionFromTheOutside.

Impact

Any transaction that has been signed and is otherwise valid will be executed, even if the signature is invalid (is not coming from the owner). Accordingly, malicious users can drain any and all funds from the wallet.

Tools Used

Manual review, Foundry.

Recommendations

Ensure that the outcome of the signature verification is checked and that the transaction flow procceds only if the signature is valid. Perform the following modifications: