Open codehawks-bot opened 1 year ago
"The selected description regarding this finding can be found at https://www.codehawks.com/finding/clm9ckiz80003w9ecu6vtufdf. While the finding is well-explained, it focuses on just one aspect of the vulnerability. There are other important considerations, such as the possibility of using the same signature twice, which may indicate a lack of nonce or limit.
Ideally, the best findings should encompass all impacts and results stemming from existing vulnerabilities. They should also provide robust preventive measures in the 'recommendations' section. This approach ensures that end clients receive a comprehensive understanding of the issue, covering all concerns in the final report."
For me, this felt like a bit of a coin toss. I really liked the simplicity of the selected finding. Yes, it's great to be verbose, but also important to be conscise.
That being said, your submission also highlighted the lack of eip712 compatibility, so I've awarded that as well.
ProxyFactory does not prevent EIP712 replay attacks
Severity
High Risk
Relevant GitHub Links
https://github.com/Cyfrin/2023-08-sparkn/blob/0f139b2dc53905700dd29a01451b330f829653e9/src/ProxyFactory.sol#L152-L164
Summary
The contract is using OZ EIP712 implementation and it prevents from cross-chain replay attacks, but not from executing ones transaction a couple of times on the same contract implementation.
Vulnerability Details
EIP712 only defines the structure which should be used, so signed messages are represented in better way, but does not define how to prevent replay attacks. Good practices for using signature for given function is to hash all important params, include deadline for which the signature is valid and some check whether transaction with same signature is entering the contract. In this contract none of the above is implemented:
You could see this article. Here are described above-mentioned security concerns.
Impact
Replay attacks could have different impacts in different and generally they are entry points for bigger exploits. Here an example could be as follows:
We have contest A with participants x,y,Eve with percentages 20,20,60
PoC - Test
Tools Used
Manual review
Recommendations
Consider implementing nonces, deadline and hashing all important parametes as "implementation". You could see OZ ERC20Permit implementation