Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

There is No Way to Withdraw ETH from the Contract

juggernaut63

File Location:

https://github.com/Cyfrin/2024-07-biconomy/blob/d2adadc0f3105eb789329eb3c958472638692a2d/contracts/factory/BiconomyMetaFactory.sol#L28-L89

Summary

The 'BiconomyMetaFactory' contract has a function that can accept Ether, but does not have a mechanism for withdrawing that Ether. This causes the Ether entered into the contract to be trapped permanently. To overcome this problem, it is necessary to add a 'withdraw' function that allows the contract owner to withdraw Ether from the contract.

Vulnerability Details

The 'BiconomyMetaFactory' contract has several functions that allow the receipt of Ether, but no function that allows the Ether to be withdrawn. This can cause the Ether entered into the contract to be trapped and unable to be used, potentially resulting in losses for the user or contract owner.

Impact

  • Withholding of Funds

  • Potential Financial Loss

  • Inability to Manage Funds

  • Limitations on Use of Contracts

  • Security Implications

Tools Used

  • Inspection manual

  • Solidity

Recommendations

To fix this, it is necessary to add a 'withdraw' function which allows the contract owner to withdraw all the Ether in the contract to the contract owner's address.

Code snippet:

L28-L89

encoded data for the method to be called on the Factory.
/// @return createdAccount The address of the newly created Nexus account.
function deployWithFactory(address factory, bytes calldata factoryData) external payable returns (address payable createdAccount) {
require(factoryWhitelist[address(factory)], FactoryNotWhitelisted());
(bool success, bytes memory returnData) = factory.call(factoryData);
​
// Check if the call was successful
require(success, CallToDeployWithFactoryFailed());
​
// Decode the returned address
assembly {
createdAccount := mload(add(returnData, 0x20))
}
}
​
/// @notice Checks if an address is whitelisted.
/// @param factory The address to check.
/// @return True if the factory is whitelisted, false otherwise.
function isFactoryWhitelisted(address factory) public view returns (bool) {
return factoryWhitelist[factory];
}
}
Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-cannot-msg.value-not-forwarded

Appeal created

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-cannot-msg.value-not-forwarded

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.