Biconomy: Nexus
Biconomy
Submission Details
Severity: high
InvalidThe `K1Validator` omits the Nexus account address in the signature verification within the `isValidSignatureWithSender` function when it got called in `_enableMode` function , enabling replay attacks across multiple accounts owned by the same user.
Prize pool breakdown
Total prize
30,000 USDC
nSLOC
1,43321 USDC / LOC
High Medium
25,000 USDC
Low
2,750 USDC
Judges
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Community Judging
Submissions are being reviewed by the community.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.