search

tokencard / contracts

The Consumer Contract Wallet
GNU General Public License v3.0
94 stars 40 forks source link

Relayed transactions can be replayed by controller in other wallets with the same owner #565

Closed i-stam closed 4 years ago

i-stam commented 4 years ago

In the current wallet version, relayed transactions can be replayed by the controller in other wallets that have the same owner. This requires that the owner possesses 2 different wallets and the controller gets compromised or is malicious. The transactions can also be replayed if a wallet is migrated to a future version. It can be mitigated by signing the current wallet address (address(this)) along with the nonce.

mischat commented 4 years ago

Are we all happy to add this in? @draganm @nostdm @jeffreybolle ?

nostdm commented 4 years ago

That's probably the easiest solution - @i-stam do you want to add this to the execute method? I can review.

mischat commented 4 years ago

This has been addressed by this pull-request https://github.com/tokencard/contracts/pull/568

mischat commented 4 years ago

We have also solidified the code to ensure that the metatransaction was intended for the correct chain, via a chainID