Open c4-bot-2 opened 7 months ago
Picodes marked the issue as primary issue
othernet-global (sponsor) disputed
Yes, the confirmationWallet by design has the ability to prevent changes to the managed wallet.
Picodes changed the severity to QA (Quality Assurance)
Downgrading to QA as this is among the confirmationWallet's powers
Picodes marked the issue as grade-b
Lines of code
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/ManagedWallet.sol#L59-L69
Vulnerability details
Impact
The
receive()
function in theManagedWallet
contract is used to approve address changes. By sending greater than or equal to 0.05 ether to the contract, however after the confirmation, theconfirmationWallet
can DOS the proposed Wallet forever by continuously sending 0.05 ether every 29 days. This prevents finalization as it continues shifting theactiveTimelock
by 30 days on every callProof of Concept
In the receive function, the contract increases the timelock every time the confirmation wallet sends it over 0.05 ether.
Hence the
activeTimelock
never ends.Tools Used
Manual Review
Recommended Mitigation Steps
Create a boolean value which returns true everytime the confirmation wallet has confirmed. it should return false after change or after rejection and it should be require in
receive()
Assessed type
DoS