Lines of code

Vulnerability details

Impact

Users or owner can’t use extensions because of collision between extension functions and account functions

Proof of Concept

Whenever someone calls account it will check for functions inside it, if there isn’t function it goes to fallback to check extensions.
As mentioned in docs:
<https://docs.lukso.tech/standards/universal-profile/lsp6-key-manager&gt;
“when the account is called with a function that does not exist natively in its public interface. The fallback function of the linked ERC725Account will handle the call to the extension set for the function selector being called.”
so if someone wants to use an extension if that extension has collision with existing functions, he cannot use.

Tools Used

manual

Recommended Mitigation Steps

save all function selectors and add check before adding extension, for checking function collision .

Assessed type

Other

The text was updated successfully, but these errors were encountered:

All reactions