Deny of service in SmartAccountFactory
#464
Labels
3 (High Risk)
Assets can be stolen/lost/compromised directly
bug
Something isn't working
duplicate-460
satisfactory
satisfies C4 submission criteria; eligible for awards
sponsor confirmed
Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")
upgraded by judge
Original issue severity upgraded from QA/Gas by judge
Lines of code
https://github.com/code-423n4/2023-01-biconomy/blob/53c8c3823175aeb26dee5529eeefa81240a406ba/scw-contracts/contracts/smart-contract-wallet/SmartAccountFactory.sol#L34
Vulnerability details
Impact
The
salt
used for create2 does not include information from theinit
method, so it is vulnerable to front-running.Proof of Concept
it's impossible to override an existing contract in Ethereum. From EIP-684:
For that reason if the salt is repeated, the call fill fault.
bytes32 salt = keccak256(abi.encodePacked(_owner, address(uint160(_index))));
If the user want to deploy a wallet using
deployCounterFactualWallet
with the_owner=A
and_index=0
, an attacker can listen the memory pool and deploy with an higer gas, a wallet with the same owner and index, but with different_entryPoint
and_handler
so the attacker can deny the original call, and make unwanted actions in the proxy.BaseSmartAccount(proxy).init(_owner, _entryPoint, _handler);
Recommended Mitigation Steps
Include all received fields in the salt calculation.
The text was updated successfully, but these errors were encountered: