030.md

Elegant Carbon Nightingale

Medium

Missing BaseGuard::checkAfterExecution call in HatsSignerGate::_afterExecTransactionFromModule

Summary

The HatsSignerGate::_afterExecTransactionFromModule function lacks a check, specifically a call to the BaseGuard::checkAfterExecution function.

Root Cause

The HatsSignerGate::checkAfterExecution function performs a validation check by invoking BaseGuard::checkAfterExecution. However, the HatsSignerGate::_afterExecTransactionFromModule function, which is responsible for validating after transaction from module executed, does not include this check.

HatsSignerGate::_afterExecTransactionFromModule function:

function _afterExecTransactionFromModule(bool _success, Enum.Operation operation_, ISafe _safe) internal {
  ...
  // Miss this check
  // if (guard != address(0)) {
  //   BaseGuard(guard).checkAfterExecution(bytes32(0), false);
  // }

  if (operation_ == Enum.Operation.DelegateCall) _checkSafeState(_safe);

  _reentrancyGuard = 0;
}

Impact

The omission of this logic in the HatsSignerGate::_afterExecTransactionFromModule function may result in insufficient validation after transactions executed by a module.

Mitigation

Add the missing logic to the HatsSignerGate::_afterExecTransactionFromModule function:

function _afterExecTransactionFromModule(bool _success, Enum.Operation operation_, ISafe _safe) internal {
  ...
+ if (guard != address(0)) {
+  BaseGuard(guard).checkAfterExecution(bytes32(0), false);
+ }

  if (operation_ == Enum.Operation.DelegateCall) _checkSafeState(_safe);

  _reentrancyGuard = 0;
}