bcnmy / bcnmy/mexa

Incorrect Gas Validation Allows Relayer Griefing Attack

Open
#63 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
93
Forks
28
PR merge metrics
No merged PRs in 30d

Description

The [gas validation check](https://github.com/bcnmy/mexa/blob/2f4957cd2253ef7cdfbee09c0844c9b71492034e/contracts/6/forwarder/BiconomyForwarder.sol#L125) `assert(gasleft() > req.txGas / 63)` has inverted logic. It should verify `gasleft() < req.txGas / 63` to detect when a malicious relayer provides insufficient gas.
Consider
```solidity
if (gasleft() <= req.txGas / 63) {
assembly { invalid() }
}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at contracts/6/forwarder/BiconomyForwarder.sol around line 125 and review the gas validation check against the issue's insufficient-gas scenario. Done means the validation detects when a relayer provides insufficient gas and triggers the specified invalid execution path.

Written by the indexing model from the issue text.

Assessment

Tech stack
solidity
Domain
blockchain, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.