Llama - Go-Langer's results

Lines of code

https://github.com/code-423n4/2023-06-llama/blob/aac904d31639c1b4b4e97f1c76b9c0f40b8e5cee/src/LlamaCore.sol#L317 https://github.com/code-423n4/2023-06-llama/blob/aac904d31639c1b4b4e97f1c76b9c0f40b8e5cee/src/LlamaExecutor.sol#L29

Vulnerability details

Impact

Any ETH that is expected to be sent to the executor as part of the delegatecall, will not automatically be sent along with the call.

Proof of Concept

Llama Executor has an execute function, but it is not payable. When the execute function is called during executeAction function using either call or delegatecall, it does not automatically forward any value (ETH) that may have been sent to the executeAction function.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider making the execute function in the Executor payable.

function execute(address target, uint256 value, bool isScript, bytes calldata data)
  external
  payable
  returns (bool success, bytes memory result)
{
  if (msg.sender != LLAMA_CORE) revert OnlyLlamaCore();
  (success, result) = isScript ? target.delegatecall{value: msg.value}(data) : target.call{value: msg.value}(data);
}

receive() external payable { (optional)
}

By adding the payable modifier to the execute function, it becomes capable of receiving ETH along with the function call. The received ETH will be stored in the executor contract.

Assessed type

ETH-Transfer