Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

`Nexus::validateUserOp` function is Non-compliant with EIP-4337

sheep

Description:

https://eips.ethereum.org/EIPS/eip-4337

Nexus::validateUserOp function is not fully compilant with EIP-4337 as it reverts in some cases instead of returning SIG_VALIDATION_FAILED on failure.

If the account does not support signature aggregation, it MUST validate the signature is a valid signature of the userOpHash, and SHOULD return SIG_VALIDATION_FAILED (and not revert) on signature mismatch. Any other error MUST revert.

Nexus::validateUserOp function uses ModuleManager::_enableMode function to enable the validator module if it is not enabled which has revert statements on failure if require statements are no met.

Impact:

SmartAccount is a EIP-4337 compliant, might not work properly

Proof Of Concept:

function _checkEnableModeSignature(bytes32 digest, bytes calldata sig) internal view {
//@audit - address(uint160(bytes20(sig[0:20])))
address enableModeSigValidator = address(bytes20(sig[0:20]));
if (!_isValidatorInstalled(enableModeSigValidator)) {
@> revert InvalidModule(enableModeSigValidator);
}
​
if (IValidator(enableModeSigValidator).isValidSignatureWithSender(address(this), digest, sig[20:]) != ERC1271_MAGICVALUE) {
@> revert EnableModeSigError();
}
}

Recommended Mitigation:

Refactor the code that is not compliant with the EIP-4337

Updates

Lead Judging Commences

0xnevi Lead Judge
10 months ago
0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.