Project

Summary

Missing deadline in MetaTransaction and user cannot invalidate a signed Meta Transaction.

Vulnerability Details

User can sign meta transactions and allow gas relayer to execute the transactions on behalf of themselves.

However, there is no deadline in MetaTransaction struct and at the same time, no functionality is provided for users to invalidate a signed Meta Transaction, this means a signed meta transaction can be executable in any time in the future, as long as the nonce remains the same.

Impact

A meta transaction can be delayed for a very long time before it is executed, user may suffer a loss if the transaction is exeucted at a bad timing (e.g joining DAO when the DAO is essentially abandoned).

Tools Used

Manual Review

Recommendations

It is recommeded to add deadline in MetaTransaction struct, and implement a functionality for user to invalidate a signed Meta Transaction (e.g increase nonce).