Summary

In the Bootstrap contract, the registry is never called as modules are installed before calling _configureRegistry().

Vulnerability Details

According to EIP-7484, the module registry must be queried at least once before or during the transaction in which a module is installed:

A Smart Account MUST implement the following Adapter functionality either natively in the account or as a module. This Adapter functionality MUST ensure that:

• The Registry is queried about module A at least once before or during the transaction in which A is called for the first time.

However, when setting up modules and the registry for smart accounts through the Bootstrap contract, the registry is only configured after modules are installed.

Using initNexusWithSingleValidator() as example, _configureRegistry() is only called after the validator has been installed in _installValidator():

RegistryBootstrap.sol#L38-L47

As a result, when modules are installed through the Bootstrap contract, the registry is never called as registry in RegistryAdapter has not been set when the withHook modifier (which calls _checkRegistry) is reached:

RegistryAdapter.sol#L36-L42

Essentially, the order of operations in initNexusWithSingleValidator() is:

• Call _installValidator():

  • In withHook, registry == address(0) so the registry is not called.

  • Install the validator, which calls validator.onInstall().

• Call _configureRegistry(), which sets registry to the registry address.

Therefore, since the registry is never queried although onInstall() is called on the modules being installed, the function violates the EIP-7484 spec.

Note that this applies to initNexus() and initNexusScoped() as well.

Impact

When setting up modules through functions in Bootstrap, it is possible for modules not registered in the registry to be installed, which is a bypass of access control.

Recommendations

For all functions in the Bootstrap contract, consider calling _configureRegistry() before installing modules.