Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing `virtual` Keyword in `entryPoint` Function of `BaseAccount.sol`

pelz

Summary

The BaseAccount.sol contract includes a function entryPoint() which is intended to be overridden according to the documentation comments. However, the function is not marked as virtual, preventing it from being overridden in derived contracts.

Vulnerability Details

The entryPoint function in BaseAccount.sol is meant to return the address of the EntryPoint contract. The comments indicate that this function can be overridden to return a different address if needed. However, the function is not marked as virtual, which is necessary for a function to be overridden in derived contracts.

Code Snippet

/// @notice Retrieves the address of the EntryPoint contract, currently using version 0.7.
/// @dev This function returns the address of the canonical ERC4337 EntryPoint contract.
/// It can be overridden to return a different EntryPoint address if needed.
/// @return The address of the EntryPoint contract.
function entryPoint() external view returns (address) { // @audit states that it can be overridden but not marked as virtual
return _ENTRYPOINT;
}

Impact

  1. Limitation on Customization: Derived contracts cannot override the entryPoint function to return a different EntryPoint address, limiting flexibility.

  2. Inconsistent Documentation: The comments suggest that the function can be overridden, which may mislead developers.

Recommendations

Mark the entryPoint function as virtual to allow it to be overridden in derived contracts.

Suggested Fix

/// @notice Retrieves the address of the EntryPoint contract, currently using version 0.7.
/// @dev This function returns the address of the canonical ERC4337 EntryPoint contract.
/// It can be overridden to return a different EntryPoint address if needed.
/// @return The address of the EntryPoint contract.
function entryPoint() external view virtual returns (address) { // Marked as virtual to allow overriding
return _ENTRYPOINT;
}

This change will allow derived contracts to override the entryPoint function, aligning with the comments and providing greater flexibility.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-entrypoint-cannot-be-overriden

Valid low, since `_ENTRYPOINT` is defined by deployer within the `Nexus.sol` [contract](https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/Nexus.sol#L76), so even if unchanged the account could still be used. The only current supported entry point contract would be [here](https://github.com/eth-infinitism/account-abstraction/blob/develop/contracts/core/EntryPoint.sol#L605). Additionally `Nexus.sol` is an upgradeable contract, so entrypoint can be changed, so one can argue the severity of this issue could be downgraded lower.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.