Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

`validateUserOp` is not compliant with ERC-4337

zhuying

Summary

validateUserOp is not compliant with ERC-4337.

Vulnerability Details

ERC-4337:

If the account does not support signature aggregation, it MUST validate the signature is a valid signature of the userOpHash, and SHOULD return SIG_VALIDATION_FAILED (and not revert) on signature mismatch. Any other error MUST revert.

if (!op.nonce.isModuleEnableMode()) {
// Check if validator is not enabled. If not, return VALIDATION_FAILED.
if (!_isValidatorInstalled(validator)) return VALIDATION_FAILED;
validationData = IValidator(validator).validateUserOp(op, userOpHash);

If the Module Enable Mode is enabled and the validator isn't installed, validateUserOp function will return VALIDATION_FAILED and won't revert. This contradicts ERC-4337 requirements that any other error MUST revert.

Impact

validateUserOp is not compliant with ERC-4337.

Tools Used

manual

Recommendations

- if (!_isValidatorInstalled(validator)) return VALIDATION_FAILED;
+ if (!_isValidatorInstalled(validator)) revert();
Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-validateUserOp-revert-return-validator-failed

The argument for medium severity here is the potential inconsistencies with external integrations when validations does not revert during execution called from the entrypoint contract. Similar to issue #200, the impact is arguable, so would leave open for arguments during appeals period.

Appeal created

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-validateUserOp-revert-return-validator-failed

The argument for medium severity here is the potential inconsistencies with external integrations when validations does not revert during execution called from the entrypoint contract. Similar to issue #200, the impact is arguable, so would leave open for arguments during appeals period.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.