Biconomy: Nexus

Summary

The RegistryFactory.sol contract uses a deterministic deployment method for creating new accounts, but the salt calculation doesn't include the msg.sender. This could allow an attacker to front-run account creation in the event of a blockchain re-org, leading to account hijacking.

Vulnerability Details

The createAccount function in RegistryFactory.sol uses LibClone.createDeterministicERC1967 to deploy new accounts. The salt for this deployment is calculated using only the input parameters (initData and salt) without incorporating the msg.sender: https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/factory/RegistryFactory.sol#L112-L120

There are 2 issues here:

1. If two different users provide the same initData and salt, they could potentially create accounts at the same address.

2. The contract doesn't check if the account has already been initialized before calling initializeAccount, which could lead to front-running.

In the event of a blockchain reorganization, an attacker could observe a victim's transaction and quickly submit a transaction with the same parameters, potentially gaining control of the account the victim intended to create.

Impact

An attacker could potentially hijack account creation, gaining control over accounts intended for other users.

Tools Used

Manual review

Recommendations

Include msg.sender in the salt calculation to ensure uniqueness per user.