Zellic - Audit Reports

Assessment reports Public findings

Back to Zellic site

↗

Assessment reports>Biconomy PasskeyRegistry and SessionKeyManager>Threat Model>setMerkleRoot

GeneralOverview

Findings

Critical (1)

High (3)

Medium (1)

DiscussionVulnerable MerkleProof library version The `validateSessionUserOp` uses offsets

Threat ModelWhat are threat models?ERC20SessionValidationModule.sol PasskeyRegistryModule.sol

SessionKeyManagerModule.sol setMerkleRoot validateUserOp

Audit ResultsSummary

Function: `setMerkleRoot(byte[32] _merkleRoot)`

Allow any caller to set the Merkle root. The Merkle root can be modified by the msg.sender --- but exclusively for the address of the msg.sender. While the expectation is for the msg.sender to be the SmartAccount contract, in reality, it could be initiated by any caller.

The _merkleRoot is the Merkle root data containing the session keys with their permissions and parameters.

Function: setMerkleRoot(byte[32] _merkleRoot)

Function: `setMerkleRoot(byte[32] _merkleRoot)`