Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Installing the modules before configuring the registry can cause a loss of user funds.

0xrajkumar

Summary

When our account is created, we use the initializeAccount function to initialize it with some init data, which calls the bootstrap contract with delegate calls. In the bootstrap contract, we have different functions to initialize our account with modules and registry.

Vulnerability Details

In the bootstrap contract, there are three functions used to initialize our account. All these functions first install the module and then configure the registry. When installing the module, we check if it was attested by enough attesters using the withRegistry modifier. However, if our registry address is zero, it does not revert and continues the execution.

modifier withRegistry(address module, uint256 moduleType) {
_checkRegistry(module, moduleType);
_;
}
...
/**
* Check on ERC7484 Registry, if suffcient attestations were made
* This will revert, if not succicient valid attestations are on the registry
*/
function _checkRegistry(address module, uint256 moduleType) internal view {
IERC7484 moduleRegistry = registry;
if (address(moduleRegistry) != address(0)) { //--> HERE
// this will revert if attestations / threshold are not met
moduleRegistry.check(module, moduleType);
}
}

We can see initNexusWithSingleValidator, initNexus, and initNexusScoped. All these functions first install the modules and then configure the registry, which can cause the wrong module to be installed.
https://github.com/Cyfrin/2024-07-biconomy/blob/main/contracts/utils/RegistryBootstrap.sol#L38
https://github.com/Cyfrin/2024-07-biconomy/blob/main/contracts/utils/RegistryBootstrap.sol#L55
https://github.com/Cyfrin/2024-07-biconomy/blob/main/contracts/utils/RegistryBootstrap.sol#L93

Impact

This can cause a loss of user funds, a DoS attack, and other security problems. For example, in Scenario 1, a user installs a non-audited executor with bugs, allowing anyone to make calls to accounts without authorization, permitting the execution of any call on our smart account. In Scenario 2, installing the wrong hook module can cause DoS attacks.

Tools Used

Manual

Recommendations

In the bootstrap contract, we should first configure the registry and then install any module. For example, with our initNexusWithSingleValidator function:

function initNexusWithSingleValidator(
IModule validator,
bytes calldata data,
IERC7484 registry,
address[] calldata attesters,
uint8 threshold
) external {
_configureRegistry(registry, attesters, threshold); //---> First configure the registry.
_installValidator(address(validator), data);
}
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-should-registry-configure-before-module-install

Valid high, since a security feature is compromised, I believe this warrants high severity.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.