Biconomy: Nexus

Summary

validateUserOp doesn't check for validUntil and validAfter

Vulnerability Details

The 4337 EIP has a few MUSTs that need to be considered when implementing validateUserOp. One of them is time verification

The return value MUST be packed of authorizer, validUntil and validAfter timestamps.

authorizer - 0 for valid signature, 1 to mark signature failure. Otherwise, an address of an authorizer contract. This ERC defines “signature aggregator” as authorizer.
validUntil is 6-byte timestamp value, or zero for “infinite”. The UserOp is valid only up to this time.
validAfter is 6-byte timestamp. The UserOp is valid only after this time.

Having such verification is crucial for any AA wallet, as without the a plethora of vulnerabilities become possible. The simplest of them is slippage or execution at a wrong time.

For example a user may want TX1 to be executed no later than T+2h and TX2 to be execute at T+5h and afterwards.

Impact

Missing time checks. Can cause TX to execute at unwanted times.

Tools Used

Manual review

Recommendations

Implement checks to verify for validUntil and validAfter.