Exactly WebAuthn Owner Plugin

QuantstampRepository at commit 7fcf594

Quantstamp reviewed Exactly WebAuthn Owner Plugin on 8 Jul 2024: 8 findings, 0 critical; 2 marked fixed, 2 acknowledged, 4 open.

No open critical findings
Open the reportOpen Exactly WebAuthn Owner Plugin’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium001
Low421
LowOwners Are Not Properly ClearedOpen

When the plugin is uninstalled, the `onUninstall()` function is called, which clears the associated storage with the MSCA address. However, the storage is not fully cleared; only the `_owners.length` is set to 0, while the `PublicKey` array entries remain in the mapping, but become inaccessible due to the length being 0. Similarly, if an owner is removed, its storage entry is not reset, but `_owners.length` is simply decremented. This currently does not cause issues as lookup functions such as `contains()` are bound by the provided size of the array. When the plugin is reinstalled or if additional owners are added after previous removal of owners, these stale, invalid entries are overwritten. It would be a good idea to fully delete the `PublicKey` array from storage when uninstalling the plugin or deleting individual entries when removing owners to avoid potential issues with future iterations or forks of the codebase where length might not be enforced during lookup.

LowPotential Compatibility Issues with EVM ChainsOpen

`WebauthnOwnerPlugin` uses the `WebAuthn` library from the `base-org/webauthn-sol` repository as a dependency. As stated in the `webauthn-sol` documentation: > FreshCryptoLib uses the `ModExp` precompile (`address(0x05)`), which is not supported on some chains, such as [Polygon zkEVM](https://www.rollup.codes/polygon-zkevm#precompiled-contracts). This library will not work on such chains, unless they support the RIP-7212 precompile. It should be noted that the `WebauthnOwnerPlugin` may not work as expected on chains that do not support the `ModExp` and RIP-7212 precompile.

LowPotential Violation of ERC-7562 RulesOpen

When verifying a signature, the `WebAuthn` library attempts to call the RIP-7212 precompile first, and if failed, it falls back to `FreshCryptoLib`. Since the `WebAuthn.verify()` can be called during a user operation validation phase, it has to comply with the [ERC-7562](https://eips.ethereum.org/EIPS/eip-7562) rules. Rule OP-062 states that the RIP-7212 precompile can be called on networks that accept it. If not, the call to the `0x100` address is not allowed since the address does not have a deployed code and would violate Rule OP-041. As a result, the account will be incompatible with ERC-4337 on networks that do not support the RIP-7212 precompile, such as Ethereum, at the time of writing.

LowSignatures Are Valid IndefinitelyOpen

In the case of an EOA and `webAuthnAuth` signatures, there currently is no expiry time on the validity of the signature, so if the nonce has not been used yet, this signature is valid for the specific `UserOp` for an indefinite amount of time.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (4)

  • https://github.com/exactly/webauthn-owner-plugin/src/WebauthnModularAccountFactory.sol at commit 7fcf594
  • https://github.com/exactly/webauthn-owner-plugin/src/IWebauthnOwnerPlugin.sol at commit 7fcf594
  • https://github.com/exactly/webauthn-owner-plugin/src/WebauthnOwnerPlugin.sol at commit 7fcf594
  • https://github.com/exactly/webauthn-owner-plugin/src/OwnersLib.sol at commit 7fcf594

Part of Exactly WebAuthn Owner Plugin’s security record

Exactly WebAuthn Owner Plugin
Audits1 audit by 1 firmLast audit Jul 2024, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Exactly WebAuthn Owner Plugin’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us