search

sherlock-audit / 2022-10-mover-judging

1 stars 0 forks source link

Lambda - CardTopupTrusted signatures can be used multiple times / replayed #85

Closed sherlock-admin closed 2 years ago

sherlock-admin commented 2 years ago

Lambda

medium

CardTopupTrusted signatures can be used multiple times / replayed

Summary

The signatures that are generated by a backend / trusted party do not include a nonce / replay protection and can be used multiple times.

Vulnerability Detail

CardTopupTrusted directly calls recoverSigner on the (formatted) payload and does not include any nonces or other forms of replay protection

Impact

The same signature can be used for multiple approvals. I.e. a signature for 100 USDC can be used 10 times for topping up 1,000 USDC in total.

Code Snippet

https://github.com/sherlock-audit/2022-10-mover/blob/main/cardtopup_contract/contracts/HardenedTopupProxy.sol#L1033

Tool used

Manual Review

Recommendation

Include a nonce.

Duplicate of #42