Mimo August 2022 contest - wagmi's results

Lines of code

https://github.com/code-423n4/2022-08-mimo/blob/eb1a5016b69f72bc1e4fd3600a65e908bd228f13/contracts/proxy/MIMOProxyRegistry.sol#L49-L51

Vulnerability details

Impact

In MIMOProxyRegistry.deployFor() function, anyone can call to deploy for other users. And if the proxy already exists, it will revert instead of returning the existing one.

if (address(currentProxy) != address(0) && currentProxy.owner() == owner) {
  revert CustomErrors.PROXY_ALREADY_EXISTS(owner);
}

Attacker can front-run users when users try to deploy proxy, make the transaction of users revert. Users still get their proxy but it shows transaction reverted on UI, block explorer,... and affect user experience.

Proof of Concept

Consider the scenario

1. Alice called MIMOProxyRegistry.deploy() to deploy her own MIMOProxy.
2. Bob front-run Alice by calling MIMOProxyRegistry.deployFor(address(Alice)) and deploy the proxy for Alice.
3. Transaction of Alice will be reverted because the proxy already exists. She might be confused and affect her experience. Instead we can simply return the existing one for Alice in her transaction.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider to return the proxy address if it already exists in MIMOProxyRegistry.deployFor()

if (address(currentProxy) != address(0) && currentProxy.owner() == owner) {
  return currentProxy;
}