Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

ETH will stuck in BiconomyMetaFactory if someone tries to create an account with ETH.

0xrajkumar

Summary

BiconomyMetaFactory is a top-level factory that utilizes several other factories under the hood. The BiconomyMetaFactory includes a function called deployWithFactory, which deploys with a specified factory. The deployWithFactory function is payable, meaning it allows for the creation of an account with the same initial ETH that was transferred during its creation.

Vulnerability Details

In BiconomyMetaFactory, we use a low-level call to interact with other factories. However, when making a call to create, we forget to transfer the msg.value, causing the ETH to be stuck forever.

function deployWithFactory(address factory, bytes calldata factoryData) external payable returns (address payable createdAccount) {
require(factoryWhitelist[address(factory)], FactoryNotWhitelisted());
​
(bool success, bytes memory returnData) = factory.call(factoryData); //--> HERE
​
// Check if the call was successful
require(success, CallToDeployWithFactoryFailed());
​
// Decode the returned address
assembly {
createdAccount := mload(add(returnData, 0x20))
}
}

Impact

This causes the ETH to be stuck forever in BiconomyMetaFactory, resulting in the loss of user funds.

Tools Used

Manual

Recommendations

We should send msg.value with the low-level call like this:

function deployWithFactory(address factory, bytes calldata factoryData) external payable returns (address payable createdAccount) {
require(factoryWhitelist[address(factory)], FactoryNotWhitelisted());
​
(bool success, bytes memory returnData) = factory.call{ value: msg.value }(factoryData); //--> HERE
​
// Check if the call was successful
require(success, CallToDeployWithFactoryFailed());
​
// Decode the returned address
assembly {
createdAccount := mload(add(returnData, 0x20))
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-cannot-msg.value-not-forwarded

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.