-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Smart wallet owners can avoid being removed by frontrun-removing other owners. #61
Comments
raymondfam marked the issue as sufficient quality report |
raymondfam marked the issue as duplicate of #18 |
Mimicking the exploit path of #57. |
raymondfam marked the issue as duplicate of #22 |
raymondfam marked the issue as not a duplicate |
raymondfam marked the issue as duplicate of #57 |
3docSec marked the issue as not a duplicate |
3docSec marked the issue as duplicate of #18 |
3docSec changed the severity to QA (Quality Assurance) |
3docSec marked the issue as grade-a |
Hi @ZanyBonzy , I see your points, but all attacks require the attacker to have been previously added as a trusted owner, so even the most sophisticated attack can only come out of a serious mistake of the user who leaked the keys to their wallet. It can't be more than QA under this consideration. |
Closing while discussing internally |
Hi @ZanyBonzy sorry for the confusion. The issue was reopened accidentally while I was confirming with the C4 team whether QA findings like this one need to be open to be eligible for awards. The answer is no: as soon as there is a grade-a or grade-b label, the findings will receive a share of the QA pot. So the issue can stay closed without impacting awarding |
Lines of code
https://github.com/code-423n4/2024-03-coinbase/blob/e0573369b865d47fed778de00a7b6df65ab1744e/src/SmartWallet/MultiOwnable.sol#L102
Vulnerability details
Impact
The
removeOwnerAtIndex
function allows owners to be removed. The function can only be called by the owners or the contract itself. The issue is that owners can evade this removal by frontrunning the calls to the function and removing the owner that wants to remove them, thereby evading and consequently griefing other owners in the process.The
removeOwnerAtIndex
holds theonlyOwner
modifier which checks if the caller is an owner. Hence, only the owners can call.By frontrunning the call to the function, and passing other owner's address, the to-be-removed owner can grief and potentially avoid being removed as an owner.
Proof of Concept
removeOwnerAtIndex
function passing in index 2 to remove User B from owner's list._addOwnerAtIndex
to remove User A if user A gets readded.Tools Used
Manual code review
Recommended Mitigation Steps
A potential solution is limiting the calls to the
removeOwnerAtIndex
function to only the contract.Another potential solution is removing the function completely, as it introduces griefing vectors.
Assessed type
Other
The text was updated successfully, but these errors were encountered: