Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Not Restricted Range of Validation Can Cause Security Breachs

demorextess

Summary

K1Validtor contract has own custom validation function which is called validateUserOp(). As ERC4337 standards it should return success message with restricted time range. 6 bytes for validUntil timestamp and 6 bytes for validAfter timestamp should be defined for vulnerabilities.

Vulnerability Details

In K1Validator module, validation made with following lines:

function validateUserOp(PackedUserOperation calldata userOp, bytes32 userOpHash) external view returns (uint256) {
address owner = smartAccountOwners[userOp.sender];
if (
owner.isValidSignatureNow(ECDSA.toEthSignedMessageHash(userOpHash), userOp.signature) ||
owner.isValidSignatureNow(userOpHash, userOp.signature)
) {
return VALIDATION_SUCCESS;
}
return VALIDATION_FAILED;
}

If it validates the operation it returns constant VALIDATION_SUCCESS value.

VALIDATION_SUCCESS value is defined as

uint256 constant VALIDATION_SUCCESS = 0;

So, both validUntil and validAfter parameters will be 0 ( validUntil will be max value of timestamp at ENTRYPOINT implementation ) and there will be unrestricted range.

Impact

UserOperations will be valid for anytime for signed hash.
Can cause front-running issues.

Tools Used

Manual review

Recommendations

Restricting this range for a specific time range will be safe for vulnerabilities.
https://eips.ethereum.org/EIPS/eip-4337

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

finding-validateUserOp-validUntil-validAfter-ERC4337

Invalid, this check is performed in the entry point contract as seen in this instances [here](https://github.com/eth-infinitism/account-abstraction/blob/develop/contracts/core/EntryPoint.sol#L605) --> [here](https://github.com/eth-infinitism/account-abstraction/blob/develop/contracts/core/EntryPoint.sol#L574-L576)

Appeal created

demorextess Submitter
10 months ago
0xnevi Lead Judge
10 months ago
0xnevi Lead Judge
10 months ago
0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
Assigned finding tags:

finding-validateUserOp-validUntil-validAfter-ERC4337

Invalid, this check is performed in the entry point contract as seen in this instances [here](https://github.com/eth-infinitism/account-abstraction/blob/develop/contracts/core/EntryPoint.sol#L605) --> [here](https://github.com/eth-infinitism/account-abstraction/blob/develop/contracts/core/EntryPoint.sol#L574-L576)

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.