Biconomy - Smart Contract Wallet contest - prc's results

Lines of code

https://github.com/code-423n4/2023-01-biconomy/blob/53c8c3823175aeb26dee5529eeefa81240a406ba/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L460-L461 https://github.com/code-423n4/2023-01-biconomy/blob/53c8c3823175aeb26dee5529eeefa81240a406ba/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L465-L466

Vulnerability details

Impact

These functions use both onlyOwner modifier and call _requireFromEntryPointOrOwner() function. This means that, as the code is, either the access for Entrypoint address is never granted, or it was never supposed to be accessible and then the call is wrong.

Proof of Concept

    function execute(address dest, uint value, bytes calldata func) external onlyOwner{
        _requireFromEntryPointOrOwner();
        ...
    }

Tools Used

Recommended Mitigation Steps

Use either onlyOwner modifier, or call _requireFromEntryPointOrOwner() function, but not both.