Micro Wooden Meerkat
Medium
HSG has safeguards to prevent signers and modules changing the Safe state. For the checkTransaction flow it uses two layer approach:
-
Whitelist of
enabledDelegatecallTargets[]. -
On execution, HSG takes a snapshot of the safe state, and afterwards at
checkAfterExecution -> _checkSafeStateit verifies the state has not been tampered with.
The 2nd layer can be bypassed.
HSG team correctly identified that a delegate call can invoke checkTransaction outside of the regular Safe flow, and in order to mitigate it they track Safe.nonce value:
we rely on the invariant that the Safe nonce increments every time Safe.execTransaction calls out to IGuard.checkTransaction.
As such the following is mitigated:
execTransaction -> checkTransaction
add owner
direct call checkTransaction - to update the snapshotThe direct call fails since Safe.nonce has not been incremented.
However the issue is that a delegated call can modify any Safe value, including the nonce, thus the attack becomes:
execTransaction -> checkTransaction
add owner
modify nonce slot
direct call checkTransaction - to update the snapshotNo response
No response
No response
delegatecalls can modify critical Safe parameters.
It's a complicated POC and the contest ends soon, I will add one in the comments during judging phase if required.
No response