Submission Details
Severity:
`NativeMetaTransaction::executeMetaTransaction` should check if the called function is another `executeMetaTransaction`
Vulnerability Details
Since NativeMetaTransaction is inhereted by two contracts (OWPIdentity and MembershipFactory), we should check if the called function is another executeMetaTransaction to avoid recursive calls between the two contracts.
Tools Used
Manual review.
Recommendations
function executeMetaTransaction(
address userAddress,
bytes memory functionSignature,
bytes32 sigR,
bytes32 sigS,
uint8 sigV) {
+ bytes4 destinationFunctionSig = convertBytesToBytes4(functionSignature);
+ require(destinationFunctionSig != msg.sig, "functionSignature can not be of executeMetaTransaction method");
// ...
}
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
54128 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.