Coinbase Smart Wallet - Koala's results

Lines of code

https://github.com/code-423n4/2024-03-coinbase/blob/main/src/SmartWallet/CoinbaseSmartWallet.sol#L189-L212

Vulnerability details

Impact

Every owner of the smart wallet can add or remove other owners to/from the smart wallet, and can also remove all owners from the smart wallet.

Proof of Concept

Owners can interact with the smart wallet with the UserOperation and also can interact directly using execute and executeBatch function of the CoinbaseSmartWallet.

https://github.com/code-423n4/2024-03-coinbase/blob/main/src/SmartWallet/CoinbaseSmartWallet.sol#L189-L212

    /// @notice Execute the given call from this account.
    ///
    /// @dev Can only be called by the Entrypoint or an owner of this account (including itself).
    ///
    /// @param target The target call address.
    /// @param value  The call value to user.
    /// @param data   The raw call data.
    function execute(address target, uint256 value, bytes calldata data) public payable virtual onlyEntryPointOrOwner {
        _call(target, value, data);
    }

    /// @notice Execute the given list of calls from this account.
    ///
    /// @dev Can only be called by the Entrypoint or an owner of this account (including itself).
    ///
    /// @param calls The list of `Call`s to execute.
    function executeBatch(Call[] calldata calls) public payable virtual onlyEntryPointOrOwner {
        for (uint256 i; i < calls.length;) {
            _call(calls[i].target, calls[i].value, calls[i].data);
            unchecked {
                ++i;
            }
        }
    }

_call(target, value, data) allows any owner can do any operation using CoinbaseSmartWallet.

So, malicious owner can call this _call function to add or remove the owners of the CoinbaseSmartWallet.

And all of the asset and operations of the CoinbaseSmartWallet can be managed by any ower.

So it have the same vulnerabilities of the traditional EOA.

Tools Used

Manual review

Recommended Mitigation Steps

Add the additional sercurity functions to prevent the traditional vulnerabilities.

And restrict the permission to add or remove the owners.

Assessed type

Other