Biconomy: Nexus

Summary

decode and decodeBasic functions use incorrect bit manipulation operations to extract the different components of the ExecutionMode. The current implementation uses left shifts (shl) instead of right shifts (shr), which will result in incorrect isolation of each component.

Vulnerability Details

The decode function iis intended to extract the CallType, ExecType, ModeSelector, and ModePayload from the ExecutionMode. Albeit, the way this is implemented uses left shifts (shl) to try to isolate these components, which is not correct. The relevant bits are moved out of the 256-bit word instead of being isolated.

Take a look at the decode function: https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/lib/ModeLib.sol#L87-L96

_calltype is assigned the entire mode value instead of just the most significant byte. Also _execType, _modeSelector, and _modePayload are shifted left, moving the relevant bits out of the 256-bit word instead of isolating them.

The decodeBasic function suffers from the same issue.

These decode functions dont correctly extract the components according to the intended bit layout in the NATSPEC:

Impact

The incorrect bit manipulation results in the decode and decodeBasic functions not correctly extracting the components of the ExecutionMode as the extracted values will not represent the intended CallType, ExecType, ModeSelector, and ModePayload.

Tools Used

Manual review

Recommendations

Modify the decode function to use right shifts (shr) and appropriate masking. Something similar to this:

Similarly, update the decodeBasic function: