UniStaker Infrastructure - imare's results

Lines of code

https://github.com/code-423n4/2024-02-uniswap-foundation/blob/5a2761c8277541a24bc551fbd624413b384bea94/src/UniStaker.sol#L315

Vulnerability details

Impact

If a user decides that a signature for a UniStaker operation is not to be used anymore there is no implementation that provides this functionality of invalidating a valid signature. Making such signature operation valid forever until a signature transaction is consumed.

Proof of Concept

If the user decides to rescind a provided signature he/she is unable to do so.

A user signature operation on UniStaker contract can be currently "invalidated" only if consumed in a transaction.

The user creating a signature should be able to invalidate an existing signature by invalidate/increment the user nonce which is used on the signature verification.

In the UniStaker contract there are many methods that use signatures to carry operation in the name of the user which created the specific operation signature:

https://github.com/code-423n4/2024-02-uniswap-foundation/blob/5a2761c8277541a24bc551fbd624413b384bea94/src/UniStaker.sol#L315 https://github.com/code-423n4/2024-02-uniswap-foundation/blob/5a2761c8277541a24bc551fbd624413b384bea94/src/UniStaker.sol#L382 https://github.com/code-423n4/2024-02-uniswap-foundation/blob/5a2761c8277541a24bc551fbd624413b384bea94/src/UniStaker.sol#L423 https://github.com/code-423n4/2024-02-uniswap-foundation/blob/5a2761c8277541a24bc551fbd624413b384bea94/src/UniStaker.sol#L466 https://github.com/code-423n4/2024-02-uniswap-foundation/blob/5a2761c8277541a24bc551fbd624413b384bea94/src/UniStaker.sol#L512 https://github.com/code-423n4/2024-02-uniswap-foundation/blob/5a2761c8277541a24bc551fbd624413b384bea94/src/UniStaker.sol#L544

But there is no implementation that provides the ability for the same user to rescind the signature and decide to block its execution.

Tools Used

Manual review

Recommended Mitigation Steps

Add a method to UniStaker.sol contract file where the user can invalidated its nonce and in doing so block all created and not already consumed signatures:

contract UniStaker is INotifiableRewardReceiver, Multicall, EIP712, Nonces {
    ...
+   function invalidateNonce() external {
+        _useNonce(msg.sender);    
+   }
    ...

Assessed type

Other