Submission Details
Severity:
## Missing Validation for _nextAction Before Execution
### Summary:
The runNextAction function deletes the nextAction state variable before validating if _nextAction contains valid data. This exposes the function to potential misuse if nextAction was tampered with or left uninitialized, leading to unexpected behavior.
Vulnerability Details:
The function copies nextAction into a local variable _nextAction and immediately deletes the original state variable.
It proceeds to execute actions based on _nextAction.selector without verifying its validity.
If nextAction was modified maliciously or unintentionally left uninitialized, it could trigger unintended logic paths or cause the function to revert unexpectedly.
The absence of a validation check increases the risk of incorrect execution flow or potential exploitation.
### Impact:
Unexpected Behavior: Execution of unintended logic paths.
Potential Exploits: Malicious actors could manipulate nextAction to influence contract behavior.
Loss of Funds or System Integrity: In worst-case scenarios, could lead to financial loss or system compromise.
### Tools Used
manual review
### Recommendation:
Add Validation: Before using _nextAction, validate that its selector is a recognized action.
```soliditt
require(_nextAction.selector != NextActionSelector.NONE, "Invalid next action");
```
Updates
Lead Judging Commences
n0kto 9 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Suppositions
There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.
Prize pool breakdown
Total prize
50,000 USDC
nSLOC
1,91026
USDC / LOC
47,500
2,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.