SmartAccount and VerifyingSingletonPaymaster signature validation are not conforming to the latest EIP-4337 EntryPoint specification

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L511

Vulnerability details

Impact

The most recent canonical EntryPoint contract states that:

    /**
     * for simulation purposes, validateUserOp (and validatePaymasterUserOp) must return this value
     * in case of signature failure, instead of revert.
     */
    uint256 public constant SIG_VALIDATION_FAILED = 1;

This requirement is also described on the latest BaseAccount NatSpec, that should be inherited by SmartAccount.sol. The same goes for VerifyingPaymaster that is the sample code for VerifyingSingletonPaymaster.sol.

Proof of Concept

EntryPoint.simulateHandleOp expects SIG_VALIDATION_FAILED instead of a revert.

Tools Used

Manual review

Recommended Mitigation Steps

Update the codebase to use the latest AA source code from the repository eth-infinitism/account-abstraction repository. In addition, keep close attention to protocol changes through the developers' social media.

[c4-judge]

gzeon-c4 marked the issue as duplicate of #318

[c4-sponsor]

livingrockrises marked the issue as sponsor confirmed

[c4-judge]

gzeon-c4 marked the issue as satisfactory

[c4-judge]

gzeon-c4 marked the issue as duplicate of #498