MultiSig Timelock
First Flight #55
Beginner FriendlyWallet
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Valid

Signers do not know what they sign

fredo182

Signers do not know what they sign

Description

The transaction proposal process does not provide signers with a clear and human-readable representation of the transaction calldata. Instead, signers must approve transactions based solely on raw byte data stored in the transaction payload, which obscures the actual function call and parameters being executed.

Risk

Likelihood: High

Every transaction stores bytes.

Impact: High

This ambiguity increases the risk of signers unknowingly approving malicious or unintended transactions, potentially resulting in unauthorized fund transfers, state changes, or contract interactions.

Proof of Concept

function test_proposeTransaction_allowsAnyCalldata() public {
address recipient = address(1);
uint256 value = 0 ether;
bytes memory data = abi.encodePacked(bytes4(keccak256("drain()")));
​
vm.prank(OWNER);
vm.expectEmit(true, true, true, false);
emit MultiSigTimelock.TransactionProposed(0, recipient, value);
uint256 transactionId = wallet.proposeTransaction(recipient, value, data);
​
assertEq(wallet.getTransactionCount(), 1);
MultiSigTimelock.Transaction memory transaction = wallet.getTransaction(transactionId);
assertEq(transaction.to, recipient, "Invalid recipient");
assertEq(transaction.value, value, "Invalid value");
assertEq(transaction.data, data, "Invalid data");
assertEq(transaction.confirmations, 0, "Invalid confirmations");
assertEq(transaction.proposedAt, block.timestamp, "Invalid proposedAt");
assertEq(transaction.executed, false, "Invalid executed");
}

Mitigation

Enhance the transaction proposal workflow by including a mechanism to decode and present calldata in a human-readable format to signers prior to confirmation. This can be implemented by:

  • Integrating the contract's ABI to decode function signatures and parameters, enabling clear display of the intended action.

Updates

Lead Judging Commences

kelechikizito Lead Judge 4 days ago
Submission Judgement Published
Validated
Assigned finding tags:

No validation of Tx calldata

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!