Closed code423n4 closed 1 year ago
You can pay from your account balance, this looks off
Likely a misunderstanding of how the AA works. The user is supposed to pay the bootloader. Having the function as payable may be a bit confusing, but it is done purely to be more future-compatible (there are no plans to introduce bootloader sending funds to the user while calling this transaction, but just in case it was added there). So it is misunderstanding of how the AA pays for transaction and how the bootloader handle it.
miladpiri marked the issue as sponsor disputed
I think that this may meet the requirements for self-rekt because the sender could send more than the intended amount
That said, the finding was sent as High, and lacks detail, am closing as overly inflated
GalloDaSballo marked the issue as unsatisfactory: Overinflated severity
Lines of code
https://github.com/code-423n4/2023-03-zksync/blob/21d9a364a4a75adfa6f1e038232d8c0f39858a64/contracts/DefaultAccount.sol#L199
Vulnerability details
Impact
While paying for the transaction,
You can see that on the external call to
bootloaderAddr
they are sending an amount to pay for the gas, which is intended to come from the payForTransaction function because it is payable. The issue is that they do not check whether the amount was actually sent. Therefore funds already in the contract, will be sent as the amount to thebootloaderAddr
Proof of Concept
Test to confirm that. Add the specific params that you want as the transaction:
Tools Used
Manual
Recommended Mitigation Steps
Add a check that msg.value >= amount, to avoid that the existing ether in the contract is sent as a result of non having msg.value