-
Notifications
You must be signed in to change notification settings - Fork 17
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Virtual account lacks access control #888
Labels
3 (High Risk)
Assets can be stolen/lost/compromised directly
bug
Something isn't working
duplicate-885
satisfactory
satisfies C4 submission criteria; eligible for awards
sponsor confirmed
Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")
sufficient quality report
This report is of sufficient quality
Comments
0xA5DF marked the issue as primary issue |
This was referenced Oct 8, 2023
Closed
Closed
This was referenced Oct 8, 2023
Closed
Closed
Closed
0xA5DF marked the issue as sufficient quality report |
This was referenced Oct 9, 2023
0xBugsy (sponsor) confirmed |
This was referenced Oct 21, 2023
I also found this one, for the record. My reward will be distributed among the wardens. |
alcueca marked issue #885 as primary and marked this issue as a duplicate of 885 |
alcueca marked the issue as satisfactory |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
3 (High Risk)
Assets can be stolen/lost/compromised directly
bug
Something isn't working
duplicate-885
satisfactory
satisfies C4 submission criteria; eligible for awards
sponsor confirmed
Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")
sufficient quality report
This report is of sufficient quality
Lines of code
https://github.com/code-423n4/2023-09-maia/blob/f5ba4de628836b2a29f9b5fff59499690008c463/src/VirtualAccount.sol#L85
Vulnerability details
Impact
The Virtual Account lacks access control on a function that allows arbitrary calls. This enables anyone to take any assets contained within the account.
Proof of Concept
The Virtual account has the
requiresApprovedCaller
modifier to prevent use from non-approved actors:However, the
payableCall
function is missing that modifier:Since this function performs arbitrary calls with arbitrary msg.values, this allows anyone to take all assets from the contract.
Tools Used
Manual Review
Recommended Mitigation Steps
Add the
requiresApprovedCaller
modifier to thepayableCall
function (just like all other critical functions have it)Assessed type
Other
The text was updated successfully, but these errors were encountered: