Biconomy: Nexus
Biconomy
HardhatFoundry
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

attesters are not checked to be creator of attestation whenever added

mxusee

Description

Whenever an attester is added, function addAttester is called:

function addAttester(address attester) external onlyOwner {
attesters.push(attester);
}

Inside here the owner is able to add attesters.

As per EIP 7484:

/* The Registry MUST also implement the following functionality:
​
- Verify that an attester is the creator of an attestation, for example by checking `msg.sender` or by using signatures, before storing it.

Note that this does not happen whenever adding an attester. The attester is specified and simply pushed onto the list without checking if the attester is the creator of an attestation.

Ultimately a core functionality of EIP 7484 is broken.

Recommendation

Make sure to implement some sort of logic that checks the attester to be the creator of an attestation before adding it.

Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Other
Assigned finding tags:

finding-ERC7484-invalid-attestation-verification

Invalid, - Addition of attesters are admin only functionalities so if duplicate addresses are added it would consitute admin input/call validation. - EIP-7484 is in draft mode so we should not take it as the final EIP configuration yet.

Appeal created

mxusee Submitter
11 months ago
mxusee Submitter
11 months ago
0xnevi Lead Judge
11 months ago
0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

finding-ERC7484-invalid-attestation-verification

Invalid, - Addition of attesters are admin only functionalities so if duplicate addresses are added it would consitute admin input/call validation. - EIP-7484 is in draft mode so we should not take it as the final EIP configuration yet.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.