Summary

The receiverFallback modifier from the solady library acts as a default handler for ERC721 and ERC1155 callbacks, limiting further extensibility via modules.

Vulnerability Details

The fallback() implementation in the ModuleManager contract is in charge of delegating calls to the installed fallback handler based on the function signature. The function overrides the implementation of the Receiver contract from the solady library, but still decorates it with the receiverFallback modifier:

The receiverFallback modifier from the solady library deals with the common callbacks for ERC721 and ERC1155 tokens.

If the call matches any of these three selectors, the execution stops at the modifier level, preventing the fallback() function in the ModuleManager contract from being reached.

This prevents any extensibility of these callback functions using modules. Even if the user installs a module to handle any of these selectors, execution will be halted at the receiverFallback modifier.

Impact

This issue impairs the account's extensibility, preventing it from utilizing potential modules that respond to ERC721 and ERC1155 callbacks.

Tools Used

None.

Recommendations

The implementation should first check if there is any fallback handler defined for the given selector, allowing extensibility for all potential use cases. If there isn't a fallback handler installed for the given function call, then handle the potential default cases for the ERC721 and ERC1155 callbacks.