search

hats-finance / Convergence-Finance---IBO-0x0e410e7af8e70fc5bffcdbfbdf1673ee7b3d0777

IBO, Vesting & Bond mecanism repo prepared for Hat finance audit competition
0 stars 0 forks source link

Check that call is from EOA may not hold true in the future #60

Open hats-bug-reporter[bot] opened 1 year ago

hats-bug-reporter[bot] commented 1 year ago

Github username: @Madalad Submission hash (on-chain): 0xf49898de8ab683b82d737af31430a11d18fdd7c42cd9fc246d4b2c56db23ac95 Severity: low

Description: Description\ To ensure that the caller is an EOA, msg.sender == tx.origin is used. However, EIP3074 would mean that this does not provide such a guarantee.

This EIP introduces two EVM instructions AUTH and AUTHCALL. The first sets a context variable authorized based on an ECDSA signature. The second sends a call as the authorized account. This essentially delegates control of the externally owned account (EOA) to a smart contract.

Therefore, using tx.origin to ensure msg.sender is an EOA will not hold true in the event EIP 3074 goes through.

Relevant code: https://github.com/Cvg-Finance/hats-audit/blob/main/contracts/PresaleVesting/SeedPresaleCvg.sol#L94

Attack Scenario\ Given EIP-3074, users would be able to call functions with the onlyEOA modifier using a smart contract.

Recommendation\ In it's current state the onlyEOA modifier may not fully protect against smart contracts calling the function, and it also unfairly excludes users who are using smart wallets such as Gnosis Safe. Rethink the need for the function investMint to only be callable by EOAs and update the codebase accordingly.

0xR3vert commented 1 year ago

Hello, Thanks a lot for your attention. This contract is out of scope. In conclusion we have so to consider this issue as invalid.