Submission Details
Severity:
Missing function to see or verify the transaction data in `MultiSigWallet` contract.
Description
There is `MultiSigWallet::transactions` array of `MultiSigWallet::Transaction` struct array which stores transactions. but there is funcation missing to see the transaction at particuler index to verify to both owners. Which lead to misconception between owners.
Impect
One can submit the transaction but due to missing function for verify or see the transactions users or owners cant see the transaction data, which lead to zero knowledge of transaction to other owner. And malicious transaction can be executed.
Proof of concept
Suppose there asre two user, `user1` and `user2` which are owners of the `MultiSigWallet`.
Suppose `user1` submit a transaction by calling `MultiSigWallet::submitTransaction` function. After submitting the transaction no one can see the transaction data at the index they want. This could lead to misinformation about transaction to second owner `user2`.
Recommended mitigation
Protocol should implement the function to see and verify the transaction by owners to ensure that transaction is
malicious or not.
Add this functionality to `MultiSigWallet` contract.
```diff
+ function seeTransaction(uint256 _txId) external view onlyOwners returns (address, uint256, bool, bool, bool) {
+ Transaction memory txn;
+ if (_txId < transactions.length) {
+ txn = transactions[_txId];
+ }
+ return (txn.to, txn.value, txn.approvedByOwner1, txn.approvedByOwner2, txn.executed);
+ }
```
Updates
Appeal created
n0kto 6 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Rewards breakdown
nSLOC
197This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.