Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Executor Can Make Changes On Nexus

demorextess

Summary

In Nexus contract, executeFromExecutor() function is implemented for calls coming from installed executor module and unrestricted executer calls can make changes on the Nexus.

  • Installing module ( validator included )

  • Uninstalling module ( validator included )

  • Upgrading the Nexus contract

  • Setting registry

  • withdrawDepositTo

Vulnerability Details

executeFromExecutor() function is defined as:

function executeFromExecutor(
ExecutionMode mode,
bytes calldata executionCalldata
) external payable onlyExecutorModule withHook withRegistry(msg.sender, MODULE_TYPE_EXECUTOR) returns (bytes[] memory returnData) {
(CallType callType, ExecType execType) = mode.decodeBasic();
// check if calltype is batch or single or delegate call
if (callType == CALLTYPE_SINGLE) {
returnData = _handleSingleExecutionAndReturnData(executionCalldata, execType);
} else if (callType == CALLTYPE_BATCH) {
returnData = _handleBatchExecutionAndReturnData(executionCalldata, execType);
} else if (callType == CALLTYPE_DELEGATECALL) {
returnData = _handleDelegateCallExecutionAndReturnData(executionCalldata, execType);
} else {
revert UnsupportedCallType(callType);
}
}

After checking the calltype, it directly call with defined calldata. It can also call Nexus contract back, it can gain permission of onlyEntryPointOrSelf() modifier.

Impact

  • Installing module ( validator included )

  • Uninstalling module ( validator included )

  • Upgrading the Nexus contract

  • Setting registry

  • withdrawDepositTo

Tools Used

Manual review

Recommendations

Calling Nexus contract should be restricted for executeFromExecutor() function

Updates

Lead Judging Commences

0xnevi Lead Judge
11 months ago
0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

demorextess Submitter
10 months ago
0xnevi Lead Judge
10 months ago
demorextess Submitter
10 months ago
demorextess Submitter
10 months ago
demorextess Submitter
10 months ago
demorextess Submitter
10 months ago
0xnevi Lead Judge
10 months ago
0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.