Open c4-bot-10 opened 5 months ago
raymondfam marked the issue as sufficient quality report
raymondfam marked the issue as duplicate of #18
See #18.
raymondfam marked the issue as duplicate of #22
raymondfam marked the issue as duplicate of #181
3docSec marked the issue as satisfactory
3docSec changed the severity to QA (Quality Assurance)
Lines of code
https://github.com/code-423n4/2024-03-coinbase/blob/e0573369b865d47fed778de00a7b6df65ab1744e/src/SmartWallet/CoinbaseSmartWallet.sol#L330 https://github.com/code-423n4/2024-03-coinbase/blob/e0573369b865d47fed778de00a7b6df65ab1744e/src/SmartWallet/CoinbaseSmartWallet.sol#L196 https://github.com/code-423n4/2024-03-coinbase/blob/e0573369b865d47fed778de00a7b6df65ab1744e/src/SmartWallet/CoinbaseSmartWallet.sol#L205
Vulnerability details
Impact
The current wallet implementation does not use any consensus mechanism allowing any owner to do the following dangerous things:
Proof of Concept
The following snippet of code is used to check ownership permission on all important wallet functions:
It is used in :
Wallet upgrading authentication : https://github.com/code-423n4/2024-03-coinbase/blob/e0573369b865d47fed778de00a7b6df65ab1744e/src/SmartWallet/CoinbaseSmartWallet.sol#L330
A generic execution of commands on a wallet : https://github.com/code-423n4/2024-03-coinbase/blob/e0573369b865d47fed778de00a7b6df65ab1744e/src/SmartWallet/CoinbaseSmartWallet.sol#L196 and https://github.com/code-423n4/2024-03-coinbase/blob/e0573369b865d47fed778de00a7b6df65ab1744e/src/SmartWallet/CoinbaseSmartWallet.sol#L205
The
_checkOwner
will allow any registred address to pass the ownership check and in doing so grant all permission on a wallet.Tools Used
Manual review
Recommended Mitigation Steps
I would suggest to use a consensus mechanism with a minimal amount of valid (buf from different owners) signatures before allowing authentication to important parts of the wallet contract. Something like is done in the Gnosis multisig wallet contract.
Assessed type
Access Control