Lines of code

https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/Nexus.sol#L158

Impact

The absence of the withHook modifier in the executeUserOp function allows transactions executed by the EntryPoint to bypass critical checks integrated in the installed hookModule. This renders the check in the hooks useless and can lead to unintended states of the underling smart account.

Proof of Concept

The Nexus contract is designed to manage modular smart accounts compliant with ERC-7579 and ERC-4337 standards. It includes various functions for executing transactions, such as execute, executeFromExecutor, and executeUserOp. The execute and executeFromExecutor functions are protected by the withHook modifier, which ensures that additional checks specified in the hookModul are applied before and after a transaction is executed.

However, the executeUserOp function lacks this withHook modifier. This function can only be called by the end point and is responsible for executing user operations. The absence of the withHook modifier means that any transaction executed through executeUserOp can bypass the hook checks.

Example

1. The hookModule installed for the the smart Account ensure that the account always has at least 100 USDT in it.

2. User: A user initiates a transaction to send 50 USDT to another account but the current USDT balance of the smart account is only 120 USDT. The transaction is supposed to be subject to hook checks and should therefore fail since it would lower the USDT account balance below 100.

3. EntryPoint: The transaction is processed through the EntryPoint, which calls the executeUserOp function.

4. Smart Account: The executeUserOp function executes the transaction without invoking the withHook modifier and thereby bypasses the hook checks, allowing the transaction to proceed even if it violates the conditions enforced by the hooks.

Recommended Mitigation Steps

To ensure that all transactions are subject to the installed hook checks, the withHook modifier should be added to the executeUserOp function. This will align it with the execute and executeFromExecutor functions, ensuring consistent security measures across all transaction execution paths.