Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

In Nexus.sol, Nexus::initializeAccount can't be called because ModuleManager::_initModuleManager is already called in the constructor

aimhar

Summary

In the file Nexus.sol, the function Nexus::initializeAccount should be deleted, as it has no use, since ModuleManager::_initModuleManager can't be called a second time. Adding an external function will add to te gas that is used to deploy every Nexus account, in addition to the fact that this is a payable function, which takes even more gas.

Vulnerability Details

Function Nexus::initializeAccount can't be called since _initModuleManager can only be invoked as specified in the SentinelListLib dependency.
This function is also not needed in a delegatecall since it uses Storage::_getAccountStorage which, as NatSpec specifies in Storage, is for Nexus accounts, which all call initModuleManager in constructor.
Adding a function which has no use causes higher deployment fees, for every user deploying a Nexus Smart Account.

Impact

This causes higher deployment fees for every user deploying a smart account which means worse User Experience.

Explanation

#Nexus.sol
contract Nexus is ... {
...
constructor(address anEntryPoint) {
_SELF = address(this);
require(address(anEntryPoint) != address(0), EntryPointCanNotBeZero());
_ENTRYPOINT = anEntryPoint;
@> _initModuleManager();
}
...
function initializeAccount(bytes calldata initData) external payable virtual {
_initModuleManager();
(address bootstrap, bytes memory bootstrapCall) = abi.decode(initData, (address, bytes));
(bool success, ) = bootstrap.delegatecall(bootstrapCall);
require(success, NexusInitializationFailed());
}
...
}
​
#ModuleManager.sol
contract ModuleManager is ... {
...
function _initModuleManager() internal virtual {
// account module storage
AccountStorage storage ams = _getAccountStorage();
@> ams.executors.init();
@> ams.validators.init();
}
...
}
​
#IStorage.sol
interface IStorage {
struct AccountStorage {
...
SentinelListLib.SentinelList validators;
SentinelListLib.SentinelList executors;
...
}
}
​
#dependency SentinellList.sol
library SentinelListLib {
...
// This can only be called once
function init(SentinelList storage self) internal {
@> if (alreadyInitialized(self)) revert LinkedList_AlreadyInitialized();
self.entries[SENTINEL] = SENTINEL;
}
...
}
Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

finding-initializeAccount-revert

Invalid, if a `Nexus.sol` contract is already deployed, it does not need to be initialized again within the factory as seen [here](https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/factory/NexusAccountFactory.sol#L58-L60), so no issue here

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.