Submitted by Jorgect, also found by cheatc0d3
The paymaster is an extension of the eip-4337, normally the paymaster is willing to pay a user transaction if the account can return the amount of gas at the final of the transaction.
In the context of the coinbase smart wallet, the paymaster is the contract call magicSpend.sol, This contract exposes the normal function needed to be a paymaster:
The magic spend is also implementing the entry point deposit, unlock and withdraw functions as required.
Addionally of this the magicSpend is implementing a withdraw functions for users:
Link
The problem is that validatePaymasterUserOp is consuming the same signature of the withdraw function, so user can request a transaction through the paymaster, then front runt this transaction calling the withdraw function in the magicSpend (as you notice this transaction is not being processed through the bundler so user can get this withdraw transaction first if he send the correct amount of gas to be included first) making the validatePaymasterUserOp revert because the nonce was already consumed.
Are there any griefing attacks that could cause this paymaster to be banned by bundlers?
I consider that this has to be another vulnerability, but I decided to put it here because the main problem is the same.
Run this test in file:/test/MagicSpend/Withdraw.t.sol :
Foundry
Consider adding another signer for the withdraw function different from the validatePaymasterUserOp signer.
wilsoncusack (Coinbase) acknowledged, but disagreed with severity and commented:
3docSec (judge) decreased severity to Medium and commented:
For this audit, 26 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by 0xmystery received the top score from the judge.
The following wardens also submitted reports: d3e4, Limbooo, 0xhacksmithh, imare, Circolors, Koala, doublespending, shealtielanz, 7ashraf, lsaudit, Bigsam, IceBear, Tigerfrake, ZanyBonzy, gpersoon, foxb868, 0xbrett8571, y4y, cheatc0d3, robriks, cryptphi, aycozynfada, SBSecurity, jesjupyter, and Jorgect.
