Biconomy: Nexus
Biconomy
Submission Details
Severity: low
InvalidK1Validator does not check and update the nonce of the Account , which allow signature replay attacks , which leads to drain all the funds of the account
Updates
Lead Judging Commences
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:
finding-validateUserOp-nonce
Invalid, `validateUserOp` can only be called via the `EntryPoint` contract, wherein the [nonce is appropriately updated and checked](https://github.com/eth-infinitism/account-abstraction/blob/develop/contracts/core/EntryPoint.sol#L650-L652)
Prize pool breakdown
Total prize
30,000 USDC
nSLOC
1,43321 USDC / LOC
High Medium
25,000 USDC
Low
2,750 USDC
Judges
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Community Judging
Submissions are being reviewed by the community.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.