Not initializable SmartAccount implementation contract

[code423n4]

Lines of code

https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L0

Vulnerability details

Impact

The SmartAccount implementation contract is open to exploitation because it is not initialized in the deployment process.

Proof of Concept

With the unintializable contract is possible to change the owner and selfdestruct the contract to DoS all proxy contracts, making it impossible to upgrade. To perform this attack the attacker would:

1. Use the initalize function to get ownership of SmartAccount implementation
2. Deploy malicous contract with selfdestruct functions
3. Execute selfdestruct function from malicious contract with delegatecall in implementation contract

Tools Used

Manual Analysis

Recommended Mitigation Steps

The recommendation is to initialize the implementation contract or follow OZ security advice to add _disableInitializers function to constructor of SmartAccount

constructor() {
	_disableInitializers();
}

[c4-judge]

gzeon-c4 marked the issue as duplicate of #496

[c4-sponsor]

livingrockrises marked the issue as sponsor confirmed

[c4-judge]

gzeon-c4 marked the issue as satisfactory