Closed c4-submissions closed 9 months ago
raymondfam marked the issue as low quality report
raymondfam marked the issue as duplicate of #39
alex-ppg marked the issue as not a duplicate
alex-ppg marked the issue as duplicate of #412
alex-ppg marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2023-10-brahma/blob/dd0b41031b199a0aa214e50758943712f9f574a0/contracts/src/core/TransactionValidator.sol#L181-L199
Vulnerability details
Impact
Adding a new module opens up a backdoor to the SubAccount, allowing the new module to execute any action on the SubAccount.
Proof of Concept
The checkAfterExecution function calls validatePostTransaction in the TransactionValidator.sol file, which in turn invokes the _checkSubAccountSecurityConfig function. However, in the _checkSubAccountSecurityConfig function, there is a missing check to ensure that no new modules have been introduced to the safe. When modules execute transactions on a Gnosis safe, the guard safety callbacks are not triggered. Consequently, any new module introduced is free to execute any action it wishes on the safe, creating a serious backdoor threat to the security of the safe.
Tools Used
Manual Review
Recommended Mitigation Steps
Check that no new modules have been introduced to the safe, using the getModulesPaginated()
Assessed type
Invalid Validation