Exactly WebAuthn Owner Plugin

QuantstampRepository at commit 7fcf594

Quantstamp reviewed Exactly WebAuthn Owner Plugin on 8 Jul 2024: 8 findings, 0 critical; 2 marked fixed, 2 acknowledged, 4 open.

No open critical findings
Open the reportOpen Exactly WebAuthn Owner Plugin’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium001
Low421
MediumIncorrect Implementation of `updateOwnersPublicKeys()`Fixed

The `updateOwnersPublicKeys()` function of the `WebauthnOwnerPlugin` contract needs to be adjusted or can be improved as follows: 1. When an owner is removed from the owner array, it is either replaced by a new owner or the last owner in the array. In either case, the `ownerCount` is decreased by one, which shouldn't be the case if a new owner replaces the removed owner. The redundant decrease of the owner array length could cause some owners to be removed unexpectedly. 2. When a new owner replaces a removed owner, the new owner is not validated and, therefore, could contain an invalid public key or be a duplicate of an existing owner in the array. 3. The `for` loop that iterates the `ownersToRemove` array breaks when the size of the owner array is reduced to zero. As a result, some elements in `ownersToRemove` are not used but are still logged in the `OwnerUpdated()` event, which could cause inconsistency between off-chain monitoring tools and the on-chain state. 4. When adding a new owner with `owner.y == 0`, validate that `owner.x <= type(uint160).max`. Although the same check is performed in the `_validateSignature()` function, validating user input as early as possible is best practice.

LowRemove Possibility of Adding Malformed AddressesFixed

Currently `_validateSignature()` performs the following check: `owner.x > type(uint160).max`. This allows the system to verify that this is a valid address stored. It is a good practice to not allow for invalid addresses to be added in the first place, so this check should be performed at installation or owner update calls to avoid having invalid addresses altogether.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (4)

  • https://github.com/exactly/webauthn-owner-plugin/src/WebauthnModularAccountFactory.sol at commit 7fcf594
  • https://github.com/exactly/webauthn-owner-plugin/src/IWebauthnOwnerPlugin.sol at commit 7fcf594
  • https://github.com/exactly/webauthn-owner-plugin/src/WebauthnOwnerPlugin.sol at commit 7fcf594
  • https://github.com/exactly/webauthn-owner-plugin/src/OwnersLib.sol at commit 7fcf594

Part of Exactly WebAuthn Owner Plugin’s security record

Exactly WebAuthn Owner Plugin
Audits1 audit by 1 firmLast audit Jul 2024, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Exactly WebAuthn Owner Plugin’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us