🔒 H-01 - Ensure msg.value is Forwarded to Prevent Loss of User Funds

[Aboudjem]

H-01. User may lose funds when creating Nexus account or executing user operations

Issue: Users may lose funds because msg.value is ignored during the creation of a Nexus account or execution of user ops. Any ETH sent with these txs could be lost if not properly handled.

Fix: Added handling for msg.value to ensure any ETH sent with the tx is forwarded appropriately.

Summary of Fixes:

• Added handling for msg.value in the deployWithFactory, executeUserOp, and fallback functions to ensure ETH is properly forwarded.

[codecov]

Codecov Report

Attention: Patch coverage is 66.66667% with 1 line in your changes missing coverage. Please review.

Project coverage is 72.18%. Comparing base (2f9a401) to head (482e6cc).
Report is 1 commits behind head on dev.

Additional details and impacted files

@@             Coverage Diff             @@
##              dev     #113       +/-   ##
===========================================
- Coverage   87.29%   72.18%   -15.11%     
===========================================
  Files          13       13               
  Lines         559      676      +117     
  Branches      122      124        +2     
===========================================
  Hits          488      488               
- Misses         69      186      +117     
  Partials        2        2               

Files	Coverage Δ
contracts/Nexus.sol	63.42% <100.00%> (-23.30%)	⬇️
contracts/factory/BiconomyMetaFactory.sol	93.33% <100.00%> (ø)
contracts/base/ModuleManager.sol	86.62% <0.00%> (-7.17%)	⬇️

... and 5 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ad6af35...482e6cc. Read the comment docs.

[livingrockrises]

this data is initialise data?

[Aboudjem]

yep

[livingrockrises]

this is same as
https://cantina.xyz/code/d1d4b139-9705-4367-9468-297b7078674e/findings/49
so to cantina auditers we will have to show them this.

please check above link also and make sure everything is covered. and ping the PR link in thread thre.

[livingrockrises]

We have a response from spearbit.

looks good to me but note that step 4) "Other factories don't forward it in INexus(account).initializeAccount(initData)" is still missing. A different bootstrap contract might want to use msg.value?

[Aboudjem]

    function createAccount(
        address eoaOwner,
        uint256 index,
        address[] calldata attesters,
        uint8 threshold
    ) external payable returns (address payable) {
        // Compute the actual salt for deterministic deployment
        bytes32 actualSalt;
        assembly {
            let ptr := mload(0x40)
            let calldataLength := sub(calldatasize(), 0x04)
            mstore(0x40, add(ptr, calldataLength))
            calldatacopy(ptr, 0x04, calldataLength)
            actualSalt := keccak256(ptr, calldataLength)
        }

        // Deploy the Nexus contract using the computed salt
        (bool alreadyDeployed, address account) = LibClone.createDeterministicERC1967(msg.value, ACCOUNT_IMPLEMENTATION, actualSalt);

        // Create the validator configuration using the Bootstrap library
        BootstrapConfig memory validator = BootstrapLib.createSingleConfig(K1_VALIDATOR, abi.encodePacked(eoaOwner));
        bytes memory initData = BOOTSTRAPPER.getInitNexusWithSingleValidatorCalldata(validator, REGISTRY, attesters, threshold);

        // Initialize the account if it was not already deployed
        if (!alreadyDeployed) {
            INexus(account).initializeAccount{ value: msg.value }(initData);
            emit AccountCreated(account, eoaOwner, index);
        }
        return payable(account);
    }

The msg.value is already forwarded in the deployment step here, any suggestion?
(bool alreadyDeployed, address account) = LibClone.createDeterministicERC1967(msg.value, ACCOUNT_IMPLEMENTATION, actualSalt);

[livingrockrises]

just make sure all factories forward it

[github-actions]

🤖 Slither Analysis Report 🔎

Slither report

# Slither report

THIS CHECKLIST IS NOT COMPLETE. Use --show-ignored-findings to show all the results.
Summary

• constable-states (2 results) (Optimization)

constable-states

Impact: Optimization
🔴 Confidence: High

• ID-0
  RegistryAdapter.registry should be constant

base/RegistryAdapter.sol#L12

• ID-1
  RegistryFactory.threshold should be constant

factory/RegistryFactory.sol#L39

_This comment was automatically generated by the GitHub Actions workflow._

[openzeppelin-code]

🔒 H-01 - Ensure msg.value is Forwarded to Prevent Loss of User Funds

Generated at commit: c3df11cedf5fdc80f31daeaebc825eae0b24d9f8

🚨 Report Summary

	Severity Level	Results
Contracts	Critical High Medium Low Note Total	0 1 0 6 24 31

---

For more details view the full report in OpenZeppelin Code Inspector