Holographable Configuration's signature can be bypassed

[code423n4]

Lines of code

https://github.com/code-423n4/2022-10-holograph/blob/main/src/HolographFactory.sol#L118-L121
https://github.com/code-423n4/2022-10-holograph/blob/main/src/HolographFactory.sol#L234-L235

Vulnerability details

Impact

When deploying an holographable smart contract, the deployHolographableContract() method requires a signature to verify that the original creator's configuration has not been altered.

The signature verification checks the result of ecrecover() with an externally provided signer address. The result of ecrecover() and the signer address are not checked against address(0) so the verification can be bypassed by providing address(0) as the signer address.

Proof of Concept

• An invalid signature is provided to deployHolographableContract() with signer equal to address(0)
• The deployHolographableContract() methods call _verifySigner() to validate the signature
• Both ercrecover() calls return address(0) as the signatures are invalid but this is equal to signer
• The _verifySigner() function returns true, although the signature is invalid
• Signature verification has been bypassed

Tools Used

Manual review.

Recommended Mitigation Steps

Verify the return value of ecrecover() against address(0).

[gzeoneth]

Duplicate of #357

[gzeoneth]

As QA report