Tadle

Tadle
DeFiFoundry
27,750 USDC
View results
Submission Details
Severity: medium
Invalid

use CONTEXT instead of ERC2771 CONTEXT & msg.sender is not consistent in the codebase

Summary

Vulnerability Details

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/factory/TadleFactory.sol#L4

Throughout the codebase, the code uses Context for _msgSender()
The implementation chosen will resolve each _msgSender() to msg.sender which is inconsistent with the goal of
allowing MetaTX.

The code is using OpenZeppelin's Context contract which is intended to allow meta-transactions. It works by using doing a call to _msgSender() instead of querying msg.sender directly, because the method allows those special transactions.

Impact

_msgSender() to msg.sender which is inconsistent with the goal of allowing MetaTX.

Tools Used

Manual Review

Recommendations

Replace the import of Context with ERC2771Contex and as reported by the bot Use _msgsender everywhere instead of msgsender

Updates

Lead Judging Commences

0xnevi Lead Judge
about 1 year ago
0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.