Submission Details
Severity:
`NativeMetaTransaction` contract : signatures doesn't have an expiry, nor the user can invalidate his signature
## Summary
`NativeMetaTransaction` contract : signatures doesn't have an expiry, nor the user can invalidate his signature.
## Vulnerability Details
- `NativeMetaTransaction` contract is inherited by `MmebershipFactory` & `MembershipERC1155` contracts to enable users delegating their actions to a trusted relayer by a valid signature, where their transactions are executed via `NativeMetaTransaction.executeMetaTransaction()`, where the nonce of the user is increased when the transaction is executed to prevent re-executing the transaction again.
- But it was noticed that :
1. the contract doesn't have a function to invalidate the signatures by increasing the nonce of the user.
2. neither does the signatures have an expiry time to be rejected after it passed it.
## Impact
So any signed transaction can't be canceled to expired, which will result in executing transactions for users even if they decided to step back and decline their decision, or even if their transaction stayed for too long without being executed it will still be executable as there is no expiry for the signatures.
## Proof of Concept
[NativeMetaTransaction.executeMetaTransaction()](https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/meta-transaction/NativeMetaTransaction.sol#L33C5-L39C46)
```javascript
function executeMetaTransaction(
address userAddress,
bytes memory functionSignature,
bytes32 sigR,
bytes32 sigS,
uint8 sigV
) public payable returns (bytes memory) {
//...
}
```
## Tools Used
Manual Review.
## Recommendations
- Add a function to invalidate past non-executed signatures by increasing the user nonce:
```diff
+ function increaseNonce() external {
+ nonces[msg.sender]++;
+}
```
- In `NativeMetaTransaction.executeMetaTransaction()`: include the expiry in the signature and chek against it before executing the call/transaction
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.