Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Modules could maliciously revert on `onUninstall` to stop the account from uninstalling a module

x18a6

Summary

Modules could maliciously revert on onUninstall to stop the account from uninstalling a module.

Vulnerability Details

This is an expressed concern in EIP-7595 security considerations. However, there is no fix to it in the current implementation (attestation registries seems to not handle it all)

The onInstall and onUninstall functions on modules may lead to unexpected callbacks (e.g. reentrancy). Account implementations should consider this by implementing adequate protection routines. Furthermore, modules could maliciously revert on onUninstall to stop the account from uninstalling a module and removing it from the account.

Impact

Accounts become "stuck" with malicious modules. The possibilities are endless.

Proof of Concept

  • Modify MockHook::onUninstall to include a revert:

...
function onUninstall(bytes calldata) external override {
emit PostCheckCalled();
+ revert();
}
...

  • Run forge test --mt test_UninstallHookModule_Success, here is the expected output:

➜ 2024-07-biconomy git:(main) ✗ forge test --mt test_UninstallHookModule_Success
Ran 1 test suite in 142.61ms (9.87ms CPU time): 0 tests passed, 1 failed, 0 skipped (1 total tests)
​
Failing tests:
[FAIL. Reason: Hook module should be uninstalled] test_UninstallHookModule_Success() (gas: 202070)
​
Encountered a total of 1 failing tests, 0 tests succeeded

Tools Used

Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

finding-onuninstall-revert

Invalid, - hook logic is OOS - all other `onUninstall()` functions do not revert, so the hawk here is essentially introducing code logic that doesn't exist. - Known issue: > The security of Nexus smart accounts relies heavily on the modules used. Only secure and audited modules should be installed to maintain the overall security of the system.

Appeal created

x18a6 Submitter
11 months ago
0xnevi Lead Judge
11 months ago
x18a6 Submitter
11 months ago
x18a6 Submitter
11 months ago
0xnevi Lead Judge
11 months ago
0xnevi Lead Judge
11 months ago
0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Out of scope
Assigned finding tags:

finding-onuninstall-revert

Invalid, - hook logic is OOS - all other `onUninstall()` functions do not revert, so the hawk here is essentially introducing code logic that doesn't exist. - Known issue: > The security of Nexus smart accounts relies heavily on the modules used. Only secure and audited modules should be installed to maintain the overall security of the system.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.