Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Failed meta txs are open to replay attacks

sovaslava

Summary

When low-level call in meta tx has failed, whole tx has revert. And nonce has not increased. So tx becomes open to reply in future.

Vulnerability Details

Function executeMetaTransaction() make low level call and if this call will not success, whole tx wil revert and nonce will not increase.

The same valid high - https://solodit.cyfrin.io/issues/h-04-eip712metatransactionexecutemetatransaction-failed-txs-are-open-to-replay-attacks-code4rena-rolla-rolla-contest-git

Impact

if low level call in meta tx has failed, it does not mean, that tx will be actual to execute in future for signer. But nonce has not increase in this case. And tx could be call again in future, when it will not be desirable

function executeMetaTransaction(
address userAddress,
bytes memory functionSignature,
bytes32 sigR,
bytes32 sigS,
uint8 sigV
) public payable returns (bytes memory) {
...
// increase nonce for user (to avoid re-use)
nonces[userAddress] = nonces[userAddress] + 1; // @audit-issue https://solodit.cyfrin.io/issues/h-04-eip712metatransactionexecutemetatransaction-failed-txs-are-open-to-replay-attacks-code4rena-rolla-rolla-contest-git
​
...
​
// Append userAddress and relayer address at the end to extract it from calling context
(bool success, bytes memory returnData) = address(this).call{value: msg.value}(
abi.encodePacked(functionSignature, userAddress)
);
require(success, "Function call not successful");

Tools Used

Manual review

Recommendations

Failed call to address(this) should still increase the nonce

Updates

Lead Judging Commences

0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

0xbrivan2 Lead Judge
about 1 year ago
0xbrivan2 Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

failed meta transactions are replayable

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!