Llama - Madalad's results

Lines of code

https://github.com/code-423n4/2023-06-llama/blob/aac904d31639c1b4b4e97f1c76b9c0f40b8e5cee/src/LlamaExecutor.sol#L29-L35

Vulnerability details

Impact

LlamaExecutor#execute is a function for making a delegate call to a target contract, with data and value defined as a parameter by the user. However the function is not payable, meaning it is not possible to pass ether when calling the function. Moreover, there does not exist a receive or payable fallback function in the contract. This makes the LlamaExecutor contract unable to receive ether and therefore unable to send ether with the call executed in the execute function.

Proof of Concept

  // @audit missing `payable` modifier
  function execute(address target, uint256 value, bool isScript, bytes calldata data)
    external
    returns (bool success, bytes memory result)
  {
    if (msg.sender != LLAMA_CORE) revert OnlyLlamaCore();
    (success, result) = isScript ? target.delegatecall(data) : target.call{value: value}(data);
  }

https://github.com/code-423n4/2023-06-llama/blob/aac904d31639c1b4b4e97f1c76b9c0f40b8e5cee/src/LlamaExecutor.sol#L29-L35

Tools Used

Manual review

Recommended Mitigation Steps

Add a payable modifier to LlamaExecutor#execute.

Assessed type

ETH-Transfer