Project

Summary

The NativeMetaTransaction.sol contract lacks a deadline parameter for signed meta-transactions. Without this deadline, signed transactions do not expire and may be executed even after the user no longer intends for them to be, potentially causing unintended actions.

Vulnerability Details

In the NativeMetaTransaction.sol contract, users sign transactions that relayers can execute on their behalf. However, the contract does not include a deadline parameter in the MetaTransaction struct or check for a time limit in the executeMetaTransaction function.

Without a deadline, a signed transaction can be executed by a relayer at any time, even if the user’s intent or conditions have changed. For example, if Alice signs a transaction intending it to be executed immediately, the relayer could store and execute it much later when conditions differ or if Alice’s account status has changed.

This lack of expiration time introduces the risk of:

• Malicious relayers could delay the execution of signed transactions, even when no longer desired by the user.

• Unexpected User Actions: If a transaction is executed when a user no longer intends to proceed, it can lead to harm for that user for example financial loss.

Impact

Without a deadline, signed transactions may be vulnerable to unintended execution, creating security and usability risks.

Tools Used

VSCode

Recommendations

Include a deadline parameter in the MetaTransaction struct and require that the transaction is executed only if block.timestamp <= deadline.