Lines of code

https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/base/ModuleManager.sol#L72C5-L110

Impact

The lack of authorization control in the fallback function allows anyone to access and execute the fallback handlers. Depending on the fallback handler his can result in unauthorized transactions, data manipulation, or other unintended behaviours, potentially compromising the security and integrity of the smart account.

Proof of Concept

1. An attacker sends a transaction to the ModuleManager contract with arbitrary data.

2. The fallback function is triggered due to the unrecognized function selector.

3. The fallback function routes the call to the corresponding fallback handler without verifying the sender's authorization.

4. The fallback handler executes the call, potentially leading to unauthorized actions.

Recommended Mitigation Steps

Implement proper authorization control in the fallback function to ensure that only authorized entities can invoke it. This can be achieved by adding a modifier to check the sender's authorization before routing the call to the fallback handler. The existing onlyEntryPointOrSelf modifier could be used or an new modifier also including executorModuls might be appropriate.