Front-running "deployCounterFactualWallet"

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccountFactory.sol#L33

Vulnerability details

Description

The deployCounterFactualWallet function deploys a smart wallet using the create2 function with a salt value that depends on the _owner and _index parameters. However, the address derivation for the deployed wallet does not depend on the _entryPoint and _handler parameters, which are used during initialization. This allows an attacker to front run the transaction and deploy a smart contract with their own _handler and _entryPoint, but same address. The attacker can then call the execFromEntryPoint function on the smart wallet, allowing them to execute any desired logic, such as changing the owner. As a result, users cannot rely on the address derivation in advance or deploy the wallet with the same address on different EVM chains.

Impact

If users rely on the address derivation in advance or try to deploy the wallet with the same address on different EVM chains, any funds sent to the wallet could potentially be withdrawn by anyone else. All in all, it could lead to the theft of user funds.

Recommended Mitigation Steps

Change formula with which salt is calculated to depends _entryPoint and _handler.

[c4-judge]

gzeon-c4 marked the issue as duplicate of #460

[c4-sponsor]

livingrockrises marked the issue as sponsor confirmed

[c4-judge]

gzeon-c4 marked the issue as satisfactory