Submission Details
Severity:
Wrongfully emited event MetaTransactionExecuted
Summary
The event MetaTransactionExecutedis emited, but the transaction can revert.
Vulnerability Details
The function executeMetaTransactionemit event MetaTransactionExecutedupon it's completion. However after the event is emited the function executes the following code:
// Append userAddress and relayer address at the end to extract it from calling context
(bool success, bytes memory returnData) = address(this).call{value: msg.value}(
abi.encodePacked(functionSignature, userAddress)
);
require(success, "Function call not successful");
If the call function fails the event is stil emited and can mislead external apps which listen for this particular event.
Impact
Misleading external apps which listen to this event
Tools Used
manual review
Recommendations
Emit the event after checking if the call function succeeded
-emit MetaTransactionExecuted(
- userAddress,
- msg.sender,
- functionSignature,
- hashMetaTransaction(metaTx)
-);
// Append userAddress and relayer address at the end to extract it from calling context
(bool success, bytes memory returnData) = address(this).call{value: msg.value}(
abi.encodePacked(functionSignature, userAddress)
);
require(success, "Function call not successful");
+emit MetaTransactionExecuted(
+ userAddress,
+ msg.sender,
+ functionSignature,
+ hashMetaTransaction(metaTx)
+);
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.