Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Inability to cancel signed commands

xmanuel

Summary

https://github.com/Cyfrin/2024-11-one-world/blob/1e872c7ab393c380010a507398d4b4caca1ae32b/contracts/meta-transaction/NativeMetaTransaction.sol#L33

Vulnerability Details

Currently, the nonce for a signed message can only be incremented through the execution of the executeMetaTransaction function.

function executeMetaTransaction(
address userAddress,
bytes memory functionSignature,
bytes32 sigR,
bytes32 sigS,
uint8 sigV
) public payable returns (bytes memory) {
MetaTransaction memory metaTx = MetaTransaction({
nonce: nonces[userAddress],
from: userAddress,
functionSignature: functionSignature
});
​
require(
verify(userAddress, metaTx, sigR, sigS, sigV),
"Signer and signature do not match"
);
​
// increase nonce for user (to avoid re-use)
nonces[userAddress] = nonces[userAddress] + 1;
​
emit MetaTransactionExecuted(
userAddress,
msg.sender,
functionSignature,
hashMetaTransaction(metaTx)
);
​
// Append userAddress and relayer address at the end to extract it from calling context
(bool success, bytes memory returnData) = address(this).call{value: msg.value}(
abi.encodePacked(functionSignature, userAddress)
);
require(success, "Function call not successful");
​
return returnData;
}
​

This design does not provide a mechanism for an owner or admin to cancel a command, which can be problematic, especially in situations where urgent cancellation of orders.

Impact

  • If a signed meta-transaction is leaked or compromised, an attacker can execute it at any time, causing unauthorized actions with no way to revoke it.

  • The owner and admin have no control to invalidate pending transactions, potentially leading to financial losses if sensitive operations are triggered by malicious actors or incorrect signatures.

Tools Used

manual

Recommendations

To address this issue, it is recommended to implement a function that allows the owner or a designated administrator to manually increment the nonce.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Design choice
0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Appeal created

xmanuel Submitter
9 months ago
0xbrivan2 Lead Judge
9 months ago
0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Design choice

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.