Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing Access Control in `K1Validators.sol::transferOwnership()`

namx05

Summary

The transferOwnership function in the K1Validators.sol contract code checks that the new owner should not be a smart contract. However, it lacks proper access control mechanisms. This allows any external caller to execute the function, leading to potential unauthorized ownership transfers.

Vulnerability Details

The function transferOwnership is designed to transfer ownership of a smart account to a new owner. However, it does not include any access control checks to ensure that only authorized users can call the function.

Impact

Any malicious user can transfer the ownership of any smart account to themselves or any other address, gaining unauthorized control over the account.

Tools Used

Manual

Recommendations

+ modifier onlyOwner() {
+ require(msg.sender == owner, "Caller is not the owner");
+ _;
+. }
​
+ function transferOwnership(address newOwner) external onlyOwner {
require(newOwner != address(0), ZeroAddressNotAllowed());
require(!_isContract(newOwner), NewOwnerIsContract());
​
smartAccountOwners[msg.sender] = newOwner;
}
Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

finding-K1Validator-access-control-issues

- Transfer of ownerships/uninstallation/installation of modules is gated to the caller, wherein the new owner can only adjust the `smartAccountOwners` storing the current owner based on caller (`msg.sender`) that called the `transferOwnership()` function. This functionalities should - Known issue > A Nexus Smart Account could be locked forever if the owner installs a validator in the wrong way and does remove all other valid validators

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.