Biconomy: Nexus

Summary

By making the event topic indexed for bytes type inside the NexusAccountFactory contract, it would lead for wrong variable to be emitted

Vulnerability Details

when the indexed keyword is used for reference type variables such as dynamic arrays or strings, it will return the hash of the mentioned variables.
Thus, the event which is supposed to inform all of the applications subscribed to its emitting transaction (e.g. front-end of the DApp, or the backend listeners to that event),
would get a meaningless and obscure 32 bytes that correspond to keccak256 of an encoded dynamic array. This may cause some problems on the DApp side and even lead to data loss.
For more information about the indexed events, check here:

(https://docs.soliditylang.org/en/v0.8.17/abi-spec.html?highlight=indexed#events)

The problem exists inside the NexusAccountFactory contract. The event AccountCreated is defined in such a way that the bytes variable of initData is indexed.
The function createAccount() is intended to create a new Nexus account with the provided initialization data.
However, with the current design, the expected parameter wouldn't be emitted properly and front-end would get a meaningless one-way hash.

https://github.com/bcnmy/nexus/blob/main/contracts/interfaces/factory/INexusAccountFactory.sol#L27

Impact

Proof of Concept

Consider this scenario as an example:

1. The function createAccount() is called

2. Inside the function createAccount() we expect to see the the bytes of initData from calldata be emitted

3. But as the event topic is defined as indexed we'll get an obscure 32-byte hash and listeners will not be notified properly. Thus, the initData would be lost in the DApp.

For test purposes, one can run this test file:

Outputs of test: (with sample initData equal to 0x9cc7a4860f0b0926603c77f2e17ec5408745d45e2b668a287ed04e3aab0ea3d0)

AccountCreated event:

AccountCreated1 event:

As it is clear from the emitted data, the AccountCreated returns the hash of the initData while the AccountCreated1 returns the original bytes variable.

Tools Used

Manual

Recommendations