Closed code423n4 closed 1 year ago
0xSorryNotSorry marked the issue as primary issue
Sidu28 marked the issue as sponsor disputed
There is no attack vector here. An attempted attacker can at best revert their own transaction.
GalloDaSballo marked the issue as unsatisfactory: Invalid
The vulnerability would be the oppsite, usage in context is fine
Lines of code
https://github.com/Layr-Labs/eigenlayer-contracts/blob/dbeb85bcd0476e06b8feebf07e33f8a53d54c029/src/contracts/core/StrategyManager.sol#L289
Vulnerability details
Impact
depositIntoStrategyWithSignature
is checking if the msg.sender is EOA or the contract and it is doing it by checkisContract()
which is not rightProof of Concept
The
isContract()
check can be passed even though if msg.sender is a smart contract ifFunction is called in the constructor.
isContract()
checks for the code length, but during construction code length is 0.Smart contract that has not been deployed yet can be used. The CREATE2 opcode can be used to deterministically calculate the address of a smart contract before it is created. This means that the user can bypass this check by calling this function before deploying the contract.
here is another Medium issue with the same title https://solodit.xyz/issues/5925
Tools Used
Manual Review
Recommended Mitigation Steps
Assessed type
Invalid Validation