DatingDapp

Summary

In MultiSigWallet contract, once a transaction is submitted and approved, there's no mechanism for owners to cancel or replace it. If a mistake is made in submitting a transaction (wrong recipient, wrong amount), owners must execute it or lose the funds in the contract (if sent to an incorrect but valid address).

Vulnerability Details

The MultiSigWallet contract allows owners to submit transactions (submitTransaction), approve them (approveTransaction), and execute them (executeTransaction). However, there's no function to delete or cancel a transaction that has been submitted but not yet executed. The transactions array stores all submitted transactions, and once a transaction is added, it remains in the array permanently, even after execution, leading to potential storage issues. The lack of a deletion mechanism forces owners to either execute a potentially flawed transaction or abandon the funds.

Impact

• Loss of Funds (High Severity): If a transaction is submitted with an incorrect recipient address or value, and both owners approve it (perhaps before realizing the mistake), the funds will be sent to the wrong address and may be irrecoverable.

• Permanent Locking of Funds (High Severity): If the incorrect recipient address is a contract without a payable fallback/receive function, or if the transaction is created with an incorrect value, the funds will be stuck in the MultiSigWallet permanently if a owner approve and execute the transaction.

• Stale transactions If the owners made error when submit the transaction, the transaction will still be stored in the contract and may cause storage issues

• Reduced Flexibility and Control (Medium Severity): The inability to delete transactions reduces the owners' ability to manage the wallet effectively and respond to changing circumstances or errors.

Tools Used

Recommendations

Implement a deleteTransaction function that allows owners to delete pending transactions.