Subject: Smart Contract Potential Vulnerabilities - Multisig 2.0
studentofcoding opened this issue · comments
Hi there!
Based on the Smart Contract, I found 1 concern that might lead to unauthorized approvals and bypassing security measures on order.func, which allows an approval to be made without proper authorization checks on this part
To address this, we should add authorization checks before allowing approvals to proceed like:
- threshold > 0: The threshold should be a positive integer.
- threshold <= signers_num: The threshold should be less than or equal to the number of signers.
- signers_num >= 1: There should be at least one signer.
which the PoC shows below
// Additional authorization checks
(int threshold, cell signers, int signers_num, cell proposers) = get_multisig_data();
throw_unless(error::unauthorized_sign, threshold > 0);
throw_unless(error::unauthorized_sign, threshold <= signers_num);
throw_unless(error::unauthorized_sign, signers_num >= 1);
approve(signer_index, sender_address, query_id);
Best Regards,
Telegram: @mousye_mousye
chatgpt, ban