Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

EIP712MetaTransaction.executeMetaTransaction() failed txs are open to replay attacks

aresaudits

Summary

duplicate of : https://github.com/code-423n4/2022-03-rolla-findings/issues/45

and also refer : https://github.com/OpenZeppelin/openzeppelin-contracts/blob/v4.5.0/contracts/metatx/MinimalForwarder.sol#L42-L66

Vulnerability Details

below is the executeMetaTransaction() function:

function executeMetaTransaction(
address userAddress,
bytes memory functionSignature,
bytes32 sigR,
bytes32 sigS,
uint8 sigV
) public payable returns (bytes memory) {
MetaTransaction memory metaTx = MetaTransaction({
nonce: nonces[userAddress],
from: userAddress,
functionSignature: functionSignature
});
​
require(
verify(userAddress, metaTx, sigR, sigS, sigV),
"Signer and signature do not match"
);
​
// increase nonce for user (to avoid re-use)
nonces[userAddress] = nonces[userAddress] + 1;
​
emit MetaTransactionExecuted(
userAddress,
msg.sender,
functionSignature,
hashMetaTransaction(metaTx)
);//@audit - checkout https://github.com/code-423n4/2022-03-rolla-findings/issues/45
​
// Append userAddress and relayer address at the end to extract it from calling context
(bool success, bytes memory returnData) = address(this).call{value: msg.value}(
abi.encodePacked(functionSignature, userAddress)
);
require(success, "Function call not successful");
​
return returnData;
}

as mentioned in [here](https://github.com/code-423n4/2022-03-rolla-findings/issues/45) if Any transactions that fail based on some conditions that may change in the future are not safe to be executed again later (e.g. transactions that are based on others actions, or time-dependent etc).

In the current implementation, once the low-level call is failed, the whole tx will be reverted and so that

nonces[userAddress]

will remain unchanged.

As a result, the same tx can be replayed by anyone, using the same signature.

Impact

reply attacks

Tools Used

manual reveiw

Recommendations

please consider implement the below fix : https://github.com/RollaProject/quant-protocol/pull/80/commits/1f2e81aff9e88b329311ea5e3036510bf9580168

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

aresaudits Submitter
10 months ago
0xbrivan2 Lead Judge
10 months ago
aresaudits Submitter
10 months ago
0xbrivan2 Lead Judge
10 months ago
0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Validated
Assigned finding tags:

failed meta transactions are replayable

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.