Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Nonce verification is missing in the NativeMetaTransaction::executeMetaTransaction function

y0ng0p3

Summary

Nonce verification is missing in the NativeMetaTransaction::executeMetaTransaction function

Vulnerability Details

The NativeMetaTransaction::executeMetaTransaction function does not include a check to verify that the nonce used in the signature is correct and has not been used before. This omission can lead to potential signature replay attacks, where an attacker could reuse a valid signature to perform unauthorized operations.

Impact

Signature replay attacks.

Tools Used

Manual review.

Recommendations

Consider including the nonce in the function arguments and a nonce verification step in the NativeMetaTransaction::executeMetaTransaction function to ensure that each nonce is used only once. This can be achieved by checking the current nonce for the userAddress against the now provided nonce in the function call and then incrementing the nonce after a successful verification.

File: contracts/meta-transaction/NativeMetaTransaction.sol#L33-L68
​
function executeMetaTransaction(
address userAddress,
bytes memory functionSignature,
bytes32 sigR,
bytes32 sigS,
uint8 sigV,
++ uint256 nonce
) public payable returns (bytes memory) {
++ require(nonce == nonces[userAddress], "Invalid nonce");
MetaTransaction memory metaTx = MetaTransaction({
-- nonce: nonces[userAddress],
++ nonce,
from: userAddress,
functionSignature: functionSignature
});
​
require(
verify(userAddress, metaTx, sigR, sigS, sigV),
"Signer and signature do not match"
);
​
// increase nonce for user (to avoid re-use)
nonces[userAddress] = nonces[userAddress] + 1;
​
emit MetaTransactionExecuted(
userAddress,
msg.sender,
functionSignature,
hashMetaTransaction(metaTx)
);
​
// Append userAddress and relayer address at the end to extract it from calling context
(bool success, bytes memory returnData) = address(this).call{value: msg.value}(
abi.encodePacked(functionSignature, userAddress)
);
require(success, "Function call not successful");
​
return returnData;
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.