Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`executeUserOP()` in `Nexus.sol` doesn't forward `msg.value` to the target, despite being payable

sammy

Summary
executeUserOP() in Nexus.sol doesn't forward msg.value to the target, despite being payable, causing user funds to get stuck in Nexus.sol

Vulnerability Details
The exectureUserOp()function in Nexus.solis used to execute a user operation via a call using the contract's context.

function executeUserOp(PackedUserOperation calldata userOp, bytes32) external payable virtual onlyEntryPoint {
// Extract inner call data from user operation, skipping the first 4 bytes.
bytes calldata innerCall = userOp.callData[4:];
bytes memory innerCallRet = "";
​
// Check and execute the inner call if data exists.
if (innerCall.length > 0) {
// Decode target address and call data from inner call.
(address target, bytes memory data) = abi.decode(innerCall, (address, bytes));
bool success;
// Perform the call to the target contract with the decoded data.
@=> (success, innerCallRet) = target.call(data);
// Ensure the call was successful.
require(success, InnerCallFailed());
}
​
// Emit the Executed event with the user operation and inner call return data.
emit Executed(userOp, innerCallRet);
}

The function uses target.call(data)to perform the desired user operation. The function is payable, and the user is expected to send ETH with the transaction if the task requires some ETH. However, this ETH is not forwarded to the target along with the call and instead gets stuck inside the Nexus.solcontract. This also makes exectureUserOp() incompatible with a lot of operations that require ETH.

Impact

Funds will get stuck in Nexus.solaccount. However, the funds can be utilized by using the execute()function instead. This breaks the core functionality of the contract. Therefore, it qualifies as Medium severity.

Tools Used

Manual Review

Recommendations

+ (success, innerCallRet) = target.call{value : msg.value}(data);
_ (success, innerCallRet) = target.call(data);
Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-cannot-msg.value-not-forwarded

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.