Submitted by Taylor_Webb, also found by ladboy233
The SubAccount operator can steal funds from the SubAccount Gnosis Safe via the Gnosis Safe gas refund mechanism, since the trusted validator signatures do not include the following parameters that are included in the Safe.sol execTransaction function:
This allows the operator to call execTransaction with these parameters set to send all the Ether or a chosen ERC-20 token held in the SubAccount Gnosis Safe to the operators address.
One of the operators, who is an owner on the SubAccount Gnosis Safe, calls execTransaction on the Gnosis Safe with valid to, value, data, operation, and signatures parameters which is allowed by the current policy configured on the SubAccount, and therefore the trusted validator will also sign.
However, the operator will also populate execTransaction function parameters related to gas refunds (safeTxGas, baseGas, gasPrice, gasToken and refundReceiver), to values that transfer to themselves Ether or ERC-20 tokens held in the SubAccount Gnosis Safe.
The transaction is executed, and in the handlePayment function call within the Gnosis Safe execution, the Ether or ERC-20 tokens will be transferred to the address the operator specified in the refundReceiver parameter.
Include the safeTxGas, baseGas, gasPrice, gasToken and refundReceiver parameters of the transaction in the trusted validated signature that is verified.
Invalid Validation
0xad1onchain (Brahma) confirmed via duplicate Issue #484
0xsomeone (judge) decreased severity to Medium and commented:
0xad1onchain (Brahma) commented:
