Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

`msg.value` is not forwarded to fallback handlers

MiloTruck

Summary

msg.value is not forwarded to the fallback handler in the fallback function of ModuleManager.

Vulnerability Details

The fallback function of ModuleManager is declared as payable:

ModuleManager.sol#L72

fallback() external payable override(Receiver) receiverFallback {

However, when performing a call to the fallback handler, the ETH sent is not forwarded:

ModuleManager.sol#L102

if iszero(call(gas(), handler, 0, 0, add(calldatasize(), 20), 0, 0)) {

Therefore, if a fallback handler is called with msg.value, the ETH sent will not be sent to the fallback handler, but will remain in the Nexus account instead.

Impact

The functionality of fallback handlers is unnecessarily limited as Nexus accounts cannot send ETH to them. Owners will never be able to add fallback handlers that use ETH to their Nexus accounts.

Recommendations

Either remove payable from the fallback function:

- fallback() external payable override(Receiver) receiverFallback {
+ fallback() external override(Receiver) receiverFallback {

Or forward msg.value when calling the fallback function:

- if iszero(call(gas(), handler, 0, 0, add(calldatasize(), 20), 0, 0)) {
+ if iszero(call(gas(), handler, callvalue(), 0, add(calldatasize(), 20), 0, 0)) {
Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-cannot-msg.value-not-forwarded

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.