Project

Summary

Since there’s no nonce or timestamp check in this function, an attacker could reuse a valid signature from a previous transaction, effectively replaying an old transaction.

Vulnerability Details

if a user signed a transaction that performs a specific action, an attacker could repeatedly reuse this signature to trigger the same action multiple times.
https://github.com/Cyfrin/2024-11-one-world/blob/main/contracts/meta-transaction/NativeMetaTransaction.sol#L90-#L107

Impact

This would allow the attacker to repeatedly potentially draining funds or causing unexpected state changes in the contract.

Tools Used

Manual code review

Recommendations

Add a nonce field in MetaTransaction and store the used nonces for each signer in the contract.