Biconomy: Nexus

Summary

There are two different errors in the typehash for the ModuleEnableMode structure, resulting in incompatibility with the EIP-712 standard.

Vulnerability Details

The typehash for the ModuleEnableMode structure is defined in the MODULE_ENABLE_MODE_TYPE_HASH constant as the following:

The first error is the blank space after the first comma between the members. According to the EIP-712 standard, members are joined by a "," without any blank space.

The type of a struct is encoded as name ‖ "(" ‖ member₁ ‖ "," ‖ member₂ ‖ "," ‖ … ‖ memberₙ ")" where each member is written as type ‖ " " ‖ name. For example, the above Mail struct is encoded as Mail(address from,address to,string contents).

The added space completely changes the result of the typehash:

There is another error in the data types, the typehash is used in the _getEnableModeDataHash() function:

As we can see in the code snippet, the second argument, initDataHash, is of type bytes while the typehash defined it as bytes32.

Impact

Both errors will lead to an incompatibility with the EIP-712 standard. Existing tools and signing devices that implement EIP-712 will produce signatures that will be rejected due to these small errors even if the signer is valid.

Tools Used

None.

Recommendations

Change the typehash to: