Submission Details
Severity:
User will lose ether using `deployWithFactory` function
Summary
The deployWithFactory function does not send user's ether to the factory contract locking ether inside BiconomyMetaFactory.
Root Cause
The deployWithFactory calls factory address with low-level call but it does not send msg.value. BiconomyMetaFactory does not have any ether recovery mechanism which means that all of the user's ether will be locked forever.
function deployWithFactory(address factory, bytes calldata factoryData) external payable returns (address payable createdAccount) {
require(factoryWhitelist[address(factory)], FactoryNotWhitelisted());
(bool success, bytes memory returnData) = factory.call(factoryData); //@audit-issue msg.value is missing
// Check if the call was successful
require(success, CallToDeployWithFactoryFailed());
// Decode the returned address
assembly {
createdAccount := mload(add(returnData, 0x20))
}
}
Impact
User will lose all of the send ether using deployWithFactory.
Mitigation
Send msg.value to factory with low-level call.
Example pseudocode:
function deployWithFactory(address factory, bytes calldata factoryData) external payable returns (address payable createdAccount) {
require(factoryWhitelist[address(factory)], FactoryNotWhitelisted());
- (bool success, bytes memory returnData) = factory.call(factoryData);
+ (bool success, bytes memory returnData) = factory.call{value: msg.value}(factoryData);
// Check if the call was successful
require(success, CallToDeployWithFactoryFailed());
// Decode the returned address
assembly {
createdAccount := mload(add(returnData, 0x20))
}
}
Updates
Lead Judging Commences
0xnevi over 1 year ago
Submission Judgement Published Assigned finding tags:
finding-cannot-msg.value-not-forwarded
Prize pool breakdown
Total prize
30,000 USDC
nSLOC
1,43321
USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.