Skip to content

Latest commit

 

History

History
48 lines (29 loc) · 1.49 KB

011.md

File metadata and controls

48 lines (29 loc) · 1.49 KB
Raw

Gentle Syrup Panther

High

disableModule Function can be called directly from ModifierUnowned.sol

Summary

The disableModule function in ModifierUnowned.sol being marked as public instead of internal will cause unauthorized module removals as any user can bypass the access controls implemented in HatsSignerGate.sol by calling the base contract directly.

Root Cause

In ModifierUnowned.sol, the disableModule function is incorrectly marked as public https://github.com/sherlock-audit/2024-11-hats-protocol/blob/main/hats-zodiac/src/lib/zodiac-modified/ModifierUnowned.sol#L84C1-L92C4 While HatsSignerGate.sol implements proper access controls: https://github.com/sherlock-audit/2024-11-hats-protocol/blob/main/hats-zodiac/src/HatsSignerGate.sol#L888C1-L892C4

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. Attacker identifies a target module and its previous module in the linked list
  2. Instead of calling disableModule on HatsSignerGate, attacker calls it directly on ModifierUnowned
  3. The module is disabled without any access control checks (NOT THE OWNER, OR LOCKED )

Impact

The protocol suffers from unauthorized module removals, complete loss of Safe access if all signing modules are removed.

PoC

No response

Mitigation

Change the visibility of disableModule in ModifierUnowned.sol from public to internal:

function disableModule(address prevModule, address module) `internal` virtual {
 // code 
}