Quantstamp reviewed Exactly WebAuthn Owner Plugin on 8 Jul 2024: 8 findings, 0 critical; 2 marked fixed, 2 acknowledged, 4 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 4 | 2 | 1 |
The `updateOwnersPublicKeys()` function of the `WebauthnOwnerPlugin` contract needs to be adjusted or can be improved as follows: 1. When an owner is removed from the owner array, it is either replaced by a new owner or the last owner in the array. In either case, the `ownerCount` is decreased by one, which shouldn't be the case if a new owner replaces the removed owner. The redundant decrease of the owner array length could cause some owners to be removed unexpectedly. 2. When a new owner replaces a removed owner, the new owner is not validated and, therefore, could contain an invalid public key or be a duplicate of an existing owner in the array. 3. The `for` loop that iterates the `ownersToRemove` array breaks when the size of the owner array is reduced to zero. As a result, some elements in `ownersToRemove` are not used but are still logged in the `OwnerUpdated()` event, which could cause inconsistency between off-chain monitoring tools and the on-chain state. 4. When adding a new owner with `owner.y == 0`, validate that `owner.x <= type(uint160).max`. Although the same check is performed in the `_validateSignature()` function, validating user input as early as possible is best practice.
Currently `_validateSignature()` performs the following check: `owner.x > type(uint160).max`. This allows the system to verify that this is a valid address stored. It is a good practice to not allow for invalid addresses to be added in the first place, so this check should be performed at installation or owner update calls to avoid having invalid addresses altogether.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (4)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us