Lens Protocol V2 - mrudenko's results

Lines of code

https://github.com/code-423n4/2023-07-lens/blob/cdef6ebc6266c44c7068bc1c4c04e12bf0d67ead/contracts/namespaces/LensHandles.sol#L187

Vulnerability details

Impact

Severity: Medium Likelihood: Medium

Proof of Concept

The DANGER__disableTokenGuardian function in the LensHandles.sol contract uses the onlyEOA modifier to restrict access to external owned accounts (EOAs). However, this restriction can be bypassed by calling the function from the constructor of another contract. This could allow an attacker to disable the token guardian, potentially leading to unauthorized actions.

Additionally, the getTokenGuardianDisablingTimestamp function does not use the onlyEOA modifier, which means that _tokenGuardianDisablingTimestamp[wallet] can be created from a contract. This could lead to unexpected behavior or potential manipulation of the disabling timestamp.

An attacker could create a new contract that calls the DANGER__disableTokenGuardian function in its constructor. Since the constructor is called during contract creation, it is considered an EOA during that transaction, allowing it to bypass the onlyEOA modifier.

contract Attacker {
    constructor(LensHandles target) {
        target.DANGER__disableTokenGuardian();
    }
}

Tools Used

Manual Code Review

Recommended Mitigation Steps

Apply the onlyEOA modifier or similar access controls to the getTokenGuardianDisablingTimestamp function to prevent it from being called from a contract. This could help prevent potential misuse or manipulation of the disabling timestamp.

Assessed type

Access Control