search

code-423n4 / 2023-01-biconomy-findings

10 stars 11 forks source link

Bypass SmartAccount `handlePayment` #523

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-01-biconomy/blob/53c8c3823175aeb26dee5529eeefa81240a406ba/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L247-L269

Vulnerability details

Payment can be small/zero due to rounding down if tokenGasPriceFactor is sufficiently large and function won't revert on zero transfer. Validate tokenGasPriceFactor.

c4-judge commented 1 year ago

gzeon-c4 marked the issue as unsatisfactory: Insufficient quality

c4-sponsor commented 1 year ago

livingrockrises marked the issue as sponsor disputed