Project

Summary

The meta-transaction system in NativeMetaTransaction.sol is vulnerable to signature malleability attacks. The verify function accepts multiple equivalent forms of the same signature, allowing an attacker to replay transactions with modified signature values. Unlike the previously reported ecrecover issue, this specifically impacts the protocol's nonce-based replay protection because each signature variation is treated as unique, despite representing the same transaction. This enables bypassing the nonce check and executing the same transaction multiple times.

Vulnerability Details

The vulnerability exists in the signature verification:
https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/meta-transaction/NativeMetaTransaction.sol#L90

Impact

1. Replay protection fails

2. Multiple executions possible

3. State inconsistencies

Tools Used

Manual Review

Recommendations

1. Add signature validation