Hardcoding gas costs should be avoided

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L200

Vulnerability details

Impact

The execTransaction function in SmartAccount.sol has some hard coded gas cost values like for example 21000 (the base cost of an EVM transaction). We have seen previous EVM forks changing the gas cost of some key things, for example the SSTORE opcode. This can happen again and in this case the hardcoded values might not be correct anymore which will lead to wrong accounting for incurred gas costs. Also if the project is deployed on a different EVM-compatible chain, the gas costs there might be different.

Proof of Concept

In SmartAccount.sol:

200: 	uint256 startGas = gasleft() + 21000 + msg.data.length * 8;

Tools Used

Visual Studio Code

Recommended Mitigation Steps

Initialize the expected gas costs and add setter functions to be able to update them in case of an EVM fork.

[c4-judge]

gzeon-c4 marked the issue as primary issue

[gzeoneth]

I think the risk is low and the suggested solution will significantly increase gas cost.

[c4-sponsor]

livingrockrises marked the issue as disagree with severity

[livingrockrises]

21000 is ok but as per other issues msg.data.length should not be there!
for this part i will mark it ackowledged

[c4-sponsor]

livingrockrises marked the issue as sponsor acknowledged

[livingrockrises]

#535 #489 #209 #107 #301 are not duplicates of this issue

[c4-judge]

gzeon-c4 changed the severity to QA (Quality Assurance)

[c4-judge]

gzeon-c4 marked the issue as grade-b