Submission Details
Impact:
Likelihood:
M-4: Match-wallet execute race — one owner can drain the shared pot and strand the other's approved tx
Root + Impact
When two transactions are fully cross-approved, the first executeTransaction consumes the balance; the second reverts on insufficient funds and can never be cancelled. One co-owner can route the entire shared balance to themselves and permanently strand the counterparty's approved payment.
Description
// src/MultiSig.sol
function executeTransaction(uint256 _txId) external onlyOwners {
...
@> txn.executed = true;
(bool success,) = payable(txn.to).call{value: txn.value}("");
@> require(success, "Transaction failed"); // 2nd tx fails; no cancel/expiry -> stuck
...
}
Risk
Likelihood: Low-Medium — needs two approved transactions and an adversarial co-owner.
Impact: One party captures 100% of the shared funds; the other's approved transaction is permanently unexecutable.
Proof of Concept
function test_ExecuteRaceStrandsOther() public {
MultiSigWallet w = new MultiSigWallet(address(this), address(0xBEEF));
vm.deal(address(w), 1 ether);
w.submitTransaction(address(0xA11CE), 1 ether); // tx0 -> attacker
w.approveTransaction(0);
vm.prank(address(0xBEEF)); w.approveTransaction(0);
w.executeTransaction(0); // attacker drains full balance
// a second cross-approved tx now can never execute and cannot be cancelled
}
Recommended Mitigation
+function cancelTransaction(uint256 _txId) external onlyOwners { ... }
+function revokeApproval(uint256 _txId) external onlyOwners { ... }
+function executeTransaction(uint256 _txId) external onlyOwners {
+ require(txn.value <= address(this).balance, "Insufficient balance");
...
}
Rewards breakdown
This contest has a flat reward structure with the following payouts:
Live
The contest is live. Earn rewards by submitting a finding.
Judging
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsRewards Distribution
The contest is complete and the rewards are being distributed.