Inheritable Smart Contract Wallet

Summary

The contractInteractions function allows the owner to interact with external contracts by forwarding a payload and Ether. However, the function forwards all remaining gas to the external contract.

Vulnerability Details

The vulnerability lies in the use of _target.call{value: _value}(_payload) without limiting the amount of gas forwarded to the external contract. Key issues include:

1. Unlimited Gas Forwarding:

   • By default, call forwards all remaining gas to the external contract. This allows the external contract to consume an unpredictable amount of gas, potentially causing the transaction to run out of gas and revert.

2. Out-of-Gas Errors:

   • If the external contract performs computationally expensive operations (e.g., loops, recursive calls), it could consume all the gas, causing the transaction to fail.

3. Lack of Gas Stipend for Payable Functions:

   • If the external contract is payable (i.e., it accepts Ether), it requires a small amount of gas (2,300 gas) to execute its fallback function. Without explicitly forwarding this gas stipend, the call could fail.

Impact

• Transaction Reverts: Out-of-gas errors can cause the transaction to revert, wasting gas and preventing the intended interaction.

• Unexpected Behavior: The external contract could perform expensive operations, leading to unpredictable behavior or excessive gas consumption.

• Loss of Funds: If the external contract is malicious or buggy, it could drain funds or lock them in an unrecoverable state.

Tools Used

Manual Code Review

Recommendations

• Use the gas option in call to specify a maximum amount of gas to forward to the external contract. For example:

  (bool success, bytes memory data) = _target.call{value: _value, gas: 100000}(_payload);

  • If the external contract is payable, forward a gas stipend (2,300 gas) to ensure the fallback function executes correctly:

    if (_value > 0) {

    (success, data) = _target.call{value: _value, gas: 2300}(_payload);

    } else {

    (success, data) = _target.call{value: _value, gas: 100000}(_payload);

    }