Maia DAO - Ulysses - zambody's results

Lines of code

https://github.com/code-423n4/2023-09-maia/blob/main/src/VirtualAccount.sol#L85

Vulnerability details

Impact

Having no access control for this function can lead to loss of funds for users of a VirtualAccount.

Proof of Concept

        function payableCall(PayableCall[] calldata calls) public payable returns (bytes[] memory returnData) {
          // payableCall logic (no access control here either)        
        }

Since this is a public function, anyone is able to execute payable calls on behalf of the userAddress.

Tools Used

N/A

Recommended Mitigation Steps

Add the requiresApprovedCaller modifier to the function.

Assessed type

Access Control