Biconomy Hyphen 2.0 contest - JMukesh's results

Lines of code

https://github.com/code-423n4/2022-03-biconomy/blob/04751283f85c9fc94fb644ff2b489ec339cd9ffc/contracts/security/Pausable.sol#L59

Vulnerability details

Impact

changePauser() will not work once Pauser renounce its role . when Pauser will renounce its role Pauser will be updated to address(0) due to which changePauser() function will not work

Proof of Concept

function _changePauser(address newPauser) internal { require(newPauser != address(0)); emit PauserChanged(_pauser, newPauser); _pauser = newPauser; }

function renouncePauser() external virtual onlyPauser {
    emit PauserChanged(_pauser, address(0));
    _pauser = address(0);
}

onlyPauser modifiere check "msg.sender == _pauser" , which in this case will be "msg.sender == address(0)"

Tools Used

manual reveiw

Recommended Mitigation Steps

add two step process to change Pauser that is having a pending_pauser and current_pauser