Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

Failed transactions are opened to replay attacks

fourb

Summary

In [`NativeMetaTransaction::executeMetaTransaction`](https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/meta-transaction/NativeMetaTransaction.sol#L33) whenever the low-level call fails same transaction can be replayed by anyone.

Vulnerability Details

In this function the problem is whenever the low-level call fails due to conditions that can change the whole transaction reverts which causes the nonce not to change, Hence breaking the invariant (increase nonce for user (to avoid re-use)) in the code . As we can see the nonce plays a key role in the verification and if it doesn't change attackers or anyone can replay the transaction to harm sender.

function executeMetaTransaction(
address userAddress,
bytes memory functionSignature,
bytes32 sigR,
bytes32 sigS,
uint8 sigV
) public payable returns (bytes memory) {
MetaTransaction memory metaTx = MetaTransaction({
nonce: nonces[userAddress],
from: userAddress,
functionSignature: functionSignature
});
​
require(
verify(userAddress, metaTx, sigR, sigS, sigV),
"Signer and signature do not match"
);
​
// increase nonce for user (to avoid re-use)
--> nonces[userAddress] = nonces[userAddress] + 1;
​
emit MetaTransactionExecuted(
userAddress,
msg.sender,
functionSignature,
hashMetaTransaction(metaTx)
);
​
// Append userAddress and relayer address at the end to extract it from calling context
(bool success, bytes memory returnData) = address(this).call{value: msg.value}(
abi.encodePacked(functionSignature, userAddress)
);
--> require(success, "Function call not successful");
​
return returnData;
}

The same issue was found [here](https://solodit.cyfrin.io/issues/h-04-eip712metatransactionexecutemetatransaction-failed-txs-are-open-to-replay-attacks-code4rena-rolla-rolla-contest-git) please check the example out.

Impact

Nonce can be reused and as a result anyone can replay failed transactions.

Tools Used

manual review

Recommendations

Failed transactions should still increase nonce

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

0xbrivan2 Lead Judge
12 months ago
0xbrivan2 Lead Judge 11 months ago
Submission Judgement Published
Validated
Assigned finding tags:

failed meta transactions are replayable

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.