Lack of zero address check for ecrecover allows to bypass the signature verification

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/main/contracts/HolographFactory.sol#L192-L264

Vulnerability details

Lack of zero address check for ecrecover allows to bypass the signature verification

• In HolographFactory.sol there is a function which allows to deploy holographable smart-contract by providing DeploymentConfig, signature, signer. However, it's possible to bypass the require statement which verifies the signer by passing address(0) as a signer arg and some invalid signature with v being not equal to 27 or 28. As a result ecrecover() will return address(0) for invalid signature.

Proof of Concept:

• The current tx: 0xcb1e58f6db0321b61869ea38f03d246c3809725b00be201cc0299fcd9a1dd57f on Goerli test network will disclose the scenario above.

• Also, I've simulated exact transaction using tenderly in order to debug and see state changes much closer. Click to see

• I'll attach a simple test case that helps to cover discovered scenario.

        it('should bypass the signature verification if signer is address(0)', async () => {
          signature.r = 0x${'00'.repeat(32)};
          let zeroAddress = '0x0000000000000000000000000000000000000000';
          await expect(
            l1.holographFactory.connect(deployer).deployHolographableContract(erc20Config, signature, zeroAddress)
          ).to.emit(l1.holographFactory, "BridgeableContractDeployed")
        });

• After having a disscussion with @acc01ade(dev team), i figured out that the following exploit might have major impact on Holograph protocol.

Mitigation Steps:

• Add an additional check against the signer being address(0).

    require(_verifySigner(signature.r, signature.s, signature.v, hash, signer) && signer != address(0), "HOLOGRAPH: invalid signature");

[gzeoneth]

Duplicate of #357

[gzeoneth]

Consider with #501