TransactionValidator does not validate gas token address and gas price parameter when validating the transaction

Lines of code Vulnerability details Impact TransactionValidator does not validate gas token address and gas price parameter when validating the transaction Proof of Concept the safe transaction struct is listed below: struct SafeTransactionParams Enum.Operation operation; address from; address to...

The attacker consumes the contract's balance by controlling the gas-price or gas-used.

Lines of code Vulnerability details Impact The attacker consumes all of the contract's balance by controlling the gasPrice and gasUsed. Proof of Concept function refundGasuint256 startGas internal unchecked uint256 balance = addressthis.balance; if balance == 0 return; uint256 gasPrice =...

Miners Can Manipulate tx.gasprice to Drain Users' Wallets in postIncomingMessages()

Lines of code Vulnerability details Impact The postIncomingMessages function is used to broadcast signed data indicating that a funds on an schain will be moved to mainnet. While the function performs proper signature verification, it doesn't prevent any arbitrary user from frontrunning the...