Summary

Unlike other functions that execute operations from the account, the executeUserOp() function does not trigger hook callbacks.

Vulnerability Details

ERC-7579 hook modules are supported by the Nexus smart account implementation. Both the execute() and executeFromExecutor() functions are decorated with the withHook modifier.

The withHook modifier executes the preCheck() and postCheck() callbacks if any hook module is installed.

However, the modifier is absent in the executeUserOp() function. Since this function also handles execution from the account, it should trigger the hooks, as required by the ERC-7579 standard:

Hooks are an OPTIONAL extension of this standard. Smart accounts MAY use hooks to execute custom logic and checks before and/or after the smart accounts performs a single or batched execution. To comply with this OPTIONAL extension, a smart account:

• MUST call the preCheck function of one or multiple hooks during an execution on the account

• MUST call the postCheck function of one or multiple hooks during an execution on the account

Impact

Hook callbacks are not triggered during execution in the executeUserOp() function.

Tools Used

None.

Recommendations

Decorate the executeUserOp() function with the withHook modifier.