Barz v2 #2
Barz v2 #2
Conversation
| function execute( | ||
| ExecMode _mode, | ||
| bytes calldata _executionCalldata | ||
| ) external payable override onlyEntryPointOrSelf onlyWhenUnlocked withHook { |
There was a problem hiding this comment.
allowing self-call in execute functions should be considered carefully.
there is an attack scenario here, where a user is tricked to permit a session key access to address(this).execute(), not knowing what this permission really entails.
the session key can then build a userop. that has userop.calldata with two nested executions, the first one passing the sessionkey permission, the 2nd one would be arbitrary executions. this can lead to loss of funds
There was a problem hiding this comment.
@zeroknots Actually, the execute function of the 7579 part, the MMSAFacet's execute() cannot make a self call.
Self calls can only be made when the user uses the default VerificationFacet for UserOp Validation and use executeSingle() / executeBatch() from AccountFacetV2 for execution.
But it's a good callout, something worth deep consideration.
Barz V2 Upgrade
1. Add Multi-tier Module System
Concept and Distinction between Facets and Modules
Architecture of Facets in Multi-tier Module System
MMSAFacetmakes Barz to be ERC 7579 CompliantMSCAFacetmakes Barz to be ERC 6900 Compliant2. Add V2 Migrator Facet
3. Update Compiler Version to
0.8.26