Closed c4-submissions closed 9 months ago
Invalid, safe internally increments the nonce
raymondfam marked the issue as low quality report
raymondfam marked the issue as duplicate of #129
alex-ppg marked the issue as not a duplicate
As the Sponsor has correctly specified, the non-mutating PolicyValidator:: isPolicySignatureValid
function is meant to be invoked as part of a Gnosis Safe transaction execution flow. In such a flow, the nonce
would have been incremented before it has been validated thus ensuring that policy validations are atomic.
alex-ppg marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2023-10-brahma/blob/dd0b41031b199a0aa214e50758943712f9f574a0/contracts/src/core/PolicyValidator.sol#L54
Vulnerability details
Impact
Nonce is not incremented after using signature for policy validation
Proof of Concept
In PolicyValidator.sol
there is a function
the code query the nonce from the safe wallet
but after consume the nonce to validate the policy signature, the nonce is not incremented
this allows signature replay and the same signature can be used multiple to bypass the isPolicyValidation check until the expire expires or until the nonce is incremented on the safe wallet side
Tools Used
manual review
Recommended Mitigation Steps
increment the nonce to not code reuse the nonce and signature when validating the policy signature validation
Assessed type
Access Control