Biconomy: Nexus

Summary

The fallback function in ModuleManager allows fallback handlers to be called with staticcall, which violates EIP-7579.

Vulnerability Details

The README states that Nexus is compliant with ERC-7579:

Nexus is a suite of contracts for Modular Smart Accounts compliant with ERC-7579 and ERC-4337

According to EIP-7579, fallback handlers must be invoked using call:

If the smart account has a fallback handler installed, it:

• MUST implement authorization control

• MUST use call to invoke the fallback handler

However, the fallback function in ModuleManager allows fallback handlers to be invoked using staticcall instead:

ModuleManager.sol#L78-L93

This is a violation of EIP-7579. External integrations that rely on fallback handlers could call Nexus accounts assuming that a call would be executed, but a staticcall is performed instead. This could cause the call to the fallback handler to incorrectly revert if the function called performs state changes.

Impact

Allowing fallback handlers to be called with staticcall violates EIP-7579, breaking composability with external integrations.

Recommendations

Consider only allowing fallback handlers to be called with a regular call.