Biconomy: Nexus

Summary

The installModule function in the Nexus contract does not check if a module is already installed before attempting to install it. This violates the ERC-7579 specification, which mandates that the function must revert if the module is already installed or the initialization fails.

Vulnerability Details

• Function: installModule

• Location: Nexus contract

• Issue: The function does not verify if the module is already installed before proceeding with the installation. This can lead to multiple installations of the same module, causing potential conflicts and unexpected behavior.

ERC-7579

Non-Compliance with ERC-7579

Specification Violation

The ERC-7579 standard requires that the installModule function must revert if the module is already installed or if the initialization on the module fails. The current implementation does not adhere to this requirement, making the contract non-compliant with the standard.

Interoperability Issues

Non-compliance with ERC-7579 can reduce the contract's interoperability with other systems and tools that expect adherence to this standard.

Reliability Concerns

Failing to follow the specification can lead to unexpected behavior and reduce the reliability of the contract.

Impact

• Conflicts: Reinstalling the same module without proper checks can cause conflicts in the contract's state and logic.

• Specification Violation: Failing to adhere to the ERC-7579 specification can result in non-compliance, reducing the contract's interoperability and reliability.

• Security Risks: Potential security vulnerabilities due to unexpected behavior from multiple installations of the same module.

Tools Used

• Manual Code Review

• ERC-7579 Documentation

Recommendations

Add Installation Check

• Implement a check to verify if the module is already installed before proceeding with the installation.

• Revert the transaction if the module is found to be already installed.