MultiSig Timelock
First Flight #55
Beginner FriendlyWallet
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: high

Signers do not know what they sign

Author Revealed upon completion

Signers do not know what they sign

Description

The transaction proposal process does not provide signers with a clear and human-readable representation of the transaction calldata. Instead, signers must approve transactions based solely on raw byte data stored in the transaction payload, which obscures the actual function call and parameters being executed.

Risk

Likelihood: High

Every transaction stores bytes.

Impact: High

This ambiguity increases the risk of signers unknowingly approving malicious or unintended transactions, potentially resulting in unauthorized fund transfers, state changes, or contract interactions.

Proof of Concept

function test_proposeTransaction_allowsAnyCalldata() public {
address recipient = address(1);
uint256 value = 0 ether;
bytes memory data = abi.encodePacked(bytes4(keccak256("drain()")));
​
vm.prank(OWNER);
vm.expectEmit(true, true, true, false);
emit MultiSigTimelock.TransactionProposed(0, recipient, value);
uint256 transactionId = wallet.proposeTransaction(recipient, value, data);
​
assertEq(wallet.getTransactionCount(), 1);
MultiSigTimelock.Transaction memory transaction = wallet.getTransaction(transactionId);
assertEq(transaction.to, recipient, "Invalid recipient");
assertEq(transaction.value, value, "Invalid value");
assertEq(transaction.data, data, "Invalid data");
assertEq(transaction.confirmations, 0, "Invalid confirmations");
assertEq(transaction.proposedAt, block.timestamp, "Invalid proposedAt");
assertEq(transaction.executed, false, "Invalid executed");
}

Mitigation

Enhance the transaction proposal workflow by including a mechanism to decode and present calldata in a human-readable format to signers prior to confirmation. This can be implemented by:

  • Integrating the contract's ABI to decode function signatures and parameters, enabling clear display of the intended action.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!