Summary

The executeMetaTransaction function of the contract has a Gas Griefing vulnerability, allowing anyone to send transactions with invalid or incorrect signatures. Although the transaction is rejected if the signature is invalid, the gas fee is still charged to the transaction sender. This enables an attacker to deliberately send multiple invalid transactions, depleting the user's gas or increasing transaction fees for other parties on the network.

Vulnerability Details

Gas Griefing is a security vulnerability related to the improper use of gas fees when a transaction is rejected, especially in meta-transaction systems. In the executeMetaTransaction function, the contract receives a transaction from a third party (relayer) to execute on behalf of the user. The transaction structure includes:

• userAddress: The address of the user who signed.

• functionSignature: The signature of the function the user wants to execute.

• sigR, sigS, sigV: Components of the ECDSA digital signature.

The executeMetaTransaction function calls verify to check the validity of the signature, ensuring that the signature corresponds to a valid user. If the signature does not match, the transaction is canceled, but the gas fee is still charged.

An attacker can exploit this by sending transactions with incorrect or random signatures, causing the contract to perform the verification but reject the transaction due to a mismatch. Each failed verification still incurs a gas fee, leading to unnecessary gas consumption, especially if the attack occurs on a large scale.

Impact

Anyone who sends a transaction with an incorrect signature is charged a gas fee, which results in costs for parties attempting to execute a valid transaction.

Tools Used

Manual

Recommendations

Check the signature right at the beginning and do not execute any other logic if the signature is invalid, minimizing the gas consumed for invalid transactions.