Maia DAO - Ulysses - Hama's results

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/main/src/VirtualAccount.sol#L101

Vulnerability details

Impact

The vulnerability allows attackers to execute arbitrary code in external contracts, potentially resulting in unauthorized actions, token theft, and other security breaches. The impact of this finding includes:

Arbitrary Code Execution: Attackers can craft malicious call data and execute unauthorized actions in external contracts, posing a severe security risk.

Token Theft: By exploiting this vulnerability, attackers can steal tokens or assets from users' addresses, leading to financial losses and potential reputation damage.

Proof of Concept

/// @inheritdoc IVirtualAccount
function payableCall(PayableCall[] calldata calls) public payable returns (bytes[] memory returnData) {
    uint256 valAccumulator;
    uint256 length = calls.length;
    returnData = new bytes[](length);
    PayableCall calldata _call;
    for (uint256 i = 0; i < length;) {
        _call = calls[i];
        uint256 val = _call.value;
        // Humanity will be a Type V Kardashev Civilization before this overflows - andreas
        // ~ 10^25 Wei in existence << ~ 10^76 size uint fits in a uint256
        unchecked {
            valAccumulator += val;
        }

        bool success;

        if (isContract(_call.target)) (success, returnData[i]) = _call.target.call{value: val}(_call.callData);

        if (!success) revert CallFailed();

        unchecked {
            ++i;
        }
    }

    // Finally, make sure the msg.value = SUM(call[0...i].value)
    if (msg.value != valAccumulator) revert CallFailed();
}

ack scenario: attacker call payableCall and pass data as _call.target is the malicious contract _call.callData can be abi.encodeWithSelector( ERC20.transferFrom.selector, victim, attacker, token.balanceOf(victim) ) thus attacker will steal the users tokens .

Tools Used

Manual review

Recommended Mitigation Steps

Access Control: Implement access control mechanisms to restrict who can invoke the call and payableCall functions. Only authorized users or contracts should be allowed to use these functions.

Data Validation: Perform thorough validation of the provided _calls or PayableCall[] data to ensure that the calls do not execute arbitrary or malicious code. Consider using a whitelist of trusted contract addresses or restricting the types of calls that can be made.

Code Audits: Conduct code audits and security reviews to identify and address

Assessed type

call/delegatecall