Biconomy: Nexus

https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/Nexus.sol#L218-L223

Summary

The Bootstrap contract can allow re-initialization of the account via a delegate call after the initialization , and allow any user to call initializeAccount() function which has no access control , which will lead to huge damage on the account , since it will allow any user to stael the funds of the account .

Vulnerability Details

the bootstrap contract is responsible for the initialization of the account as shown in the function initializeAccount()

this function is supposed to be called only once , since the function _initModuleManager() will revert if it called for the second time , so as shown in the function here _initModuleManager() , the function initializes the executors and the validators entries :

the function init() in the SentinelListLib library will revert if it already initialized by checking the function alreadyInitialized()

the function alreadyInitialized checks that self.entries[SENTINEL] != ZERO_ADDRESS , if the self.entries[SENTINEL] equals to ZERO_ADDRESS this check will return false ,so it will allow re-initialization of the account ,because this check will not revert if (alreadyInitialized(self)) revert LinkedList_AlreadyInitialized(); ,
if the validators.entries[SENTINEL] is set to the ZERO_ADDRESS , and executors.entries[SENTINEL] is set to the ZERO_ADDRESS .

In order to preform this attack , the bootstrap contract should access the storage slots that store self.entries[SENTINEL] in order to set them to the ZERO_ADDRESS , so the bootstrap contract can be like this :

this will give the bootstrap contract the same storage as the Nexus account , so now when tthe Factory calls the initializeAccount on the Nexus account , as shown here
https://github.com/Cyfrin/2024-07-biconomy/blob/9590f25cd63f7ad2c54feb618036984774f3879d/contracts/factory/NexusAccountFactory.sol#L58-L61

this will call the bootstrap contract , then any malicious user can set the validators and the executors and steal all the funds of the account by validating invalid userOps .

Impact

allow re-initialization of the account which exposure the account to initialized by a malicious users and set malicious validators and executors and execute any userOp that drain all the funds fromt the account .

Tools Used

vscode

Recommendations

add this check after each delegateCall done by the account to prevent setting the validators.entries[SENTINEL] and executors.entries[SENTINEL] to the ZERO_ADDRESS .