Skip to content

Commit

Permalink
Add 4337 Module v0.2.0 Audit Report (#185)
Browse files Browse the repository at this point in the history
Closes #168 

This PR adds the audit report for the v0.2.0 version of the canonical
4337 module along with a "known issues" section to the v0.1.0 version of
the module.
  • Loading branch information
nlordell authored Dec 11, 2023
1 parent d8e7aca commit d5de325
Show file tree
Hide file tree
Showing 3 changed files with 27 additions and 0 deletions.
6 changes: 6 additions & 0 deletions 4337/docs/v0.1.0/audit.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
**:warning: This version contains known issues and should not be used. :warning:**

# Audit Results

## Auditor
Expand All @@ -21,3 +23,7 @@ There are two acknowledged findings from the audit report:
## Files

- [Final audit report](audit-report-v1.1.pdf)

## Known Issues

The contract does not include all the User Operation parameters in its signature mechanism. Notably, the two missing parameters are `initCode` and `paymasterAndData`. This allows a malicious actor to execute a Safe operation with different `initCode` (causing potentially additional gas fees to the user) or `paymasterAndData` (causing the user to pay for gas fees in Ether despite not expecting it) than what the user originally intended. See section _M1_ from the [v0.2.0 audit report](../v0.2.0/audit-report-v2.0.pdf).
Binary file added 4337/docs/v0.2.0/audit-report-v2.0.pdf
Binary file not shown.
21 changes: 21 additions & 0 deletions 4337/docs/v0.2.0/audit.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
# Audit Results

## Auditor

Ackee Blockchain (<https://ackeeblockchain.com/>).

## Notes

The final audit was performed on commit [25779b5a5077e109a585993a02c4dad2209ab084](https://github.com/safe-global/safe-modules/tree/25779b5a5077e109a585993a02c4dad2209ab084).

There is one acknowledged finding from the audit report:

- _W2: Usage of `solc` optimizer_
> After careful consideration, we decided to enable the optimizer for the following reasons:
>
> - The most critical functionality, such as signature checks and replay protection, is handled by the Safe and Entrypoint contracts.
> - The entrypoint contract uses the optimizer.
## Files

- [Final audit report](audit-report-v2.0.pdf)

0 comments on commit d5de325

Please sign in to comment.