Crypto Flexs
  • DIRECTORY
  • CRYPTO
    • ETHEREUM
    • BITCOIN
    • ALTCOIN
  • BLOCKCHAIN
  • EXCHANGE
  • ADOPTION
  • TRADING
  • HACKING
  • SLOT
  • TRADE
Crypto Flexs
  • DIRECTORY
  • CRYPTO
    • ETHEREUM
    • BITCOIN
    • ALTCOIN
  • BLOCKCHAIN
  • EXCHANGE
  • ADOPTION
  • TRADING
  • HACKING
  • SLOT
  • TRADE
Crypto Flexs
Home»HACKING NEWS»Rhinestone ERC-7579 Safety Adapter Audit Summary
HACKING NEWS

Rhinestone ERC-7579 Safety Adapter Audit Summary

By Crypto FlexsOctober 28, 20244 Mins Read
Facebook Twitter Pinterest LinkedIn Tumblr Email
Rhinestone ERC-7579 Safety Adapter Audit Summary
Share
Facebook Twitter LinkedIn Pinterest Email

rhinestone’s ERC-7579 adapter for Safe smart accounts provides full ERC-4337 and ERC-7579 compliance, which is achieved by acting as a fallback handler and enabled module for Safe. As a result, all safe smart accounts can utilize all ERC-7579 modules. The adapter can be added to an existing Safe smart account. However, a launchpad has also been developed that allows you to set up new safe smart accounts using an already activated ERC-7579 adapter.

rhinestone collaborated with Ackee Blockchain Security to conduct a security review of the rhinestone ERC-7570 adapter for secure smart accounts over a period of 16 days, from June 3 to June 14, 2024.

Additionally, rhinestone collaborated with Ackee Blockchain Security and donated a total of three days of engineering time between July 2 and July 5, 2024 to conduct an incremental security review of the updated version of the Safe7579 module.

methodology

We began our review using static analysis tools, including: awake with Solidity(Wake) VS Code Extension. We then took a closer look at the logic of the contract. Used Wake testing framework for testing and fuzzing. During the review process, we paid special attention to the following:

  • Use Launchpad to ensure safe deployment,
  • Check module management logic and multi-type module installation,
  • Check for alternative handler implementations,
  • Check for possible DoS scenarios,
  • Check the possibility of precedence,
  • Ensure delegate calls are used correctly,
  • Detect possible reentrancy in your code,
  • Verify compliance with the ERC used;
  • Ensure access controls are neither too relaxed nor too strict
  • I’m looking for common problems like data validation.

range

An audit has been performed on the commit. 90dd363 The range is as follows:

  • core/
    • AccessControl.sol
    • ExecutionHelper.sol
    • initializer.sol
    • ModuleManager.sol
    • RegistryAdapter.sol
    • SetupDCUtil.sol
  • lib/
    • ExecutionLib.sol
    • ModeLib.sol
  • Utilities/
    • DCUtil.sol
    • Safe7579UserOperationBuilder.sol
  • DataTypes.sol
  • Safe7579.sol
  • Safe7579Launchpad.sol

Findings

The audit results are as follows:

critical severity

C1: ERC-4337 Counterfactual addresses can be stolen

Severity High

H1: initializeAccount Vulnerable to frontrunning

H2: Executor is not available.

medium severity

M1: Missing events and onInstall call _initModules

M2: BatchedExecUtil._tryExecute upside down success

M3: BatchedExecUtil.tryExecute single return value

M4: ModuleManager._installHook Overwriting SIG hooks

M5: Locked Aether

low severity

L1: Alternative handler CallType check

L2: Missing domain-specific message encoding. signedMessages

L3: Violation of ERC-4337 factory standard

L4: _multiTypeInstall Module type verification

warning severity

W1: postCheck The functionality is different from the EIP-7579 interface.

W2: uninstallModule Revert to a multi-type module.

W3: Hooks can prevent module removal.

W4: Missing data validation

W5: public functions prefixed with underscores

W6: Hardcoded Enum.Operation value

W7: Incomplete and unused Safe7579UserOperationBuilder

W8: missing TryExecutionFailed emit

Information Severity

I1: Duplicate code

I2: Unused code

I3: Typos and incorrect documentation

I4: Code structure

W9: Safe does not implement the validator interface.

W10: Inconsistent signature verification

I5: Unused Used

I6: Typo

conclusion

The review resulted in 28 findings, ranging in severity from informational to critical. The most severe attacks allow an attacker to first launch a Safe deployment using Launchpad and take control of smart wallets created using it (see: C1). For other high severity issues, see: Safe7579.initializeAccount Execute the function in front (H1) and the wrong context was used. withRegistry modifier Safe7579.executeFromExecutor function (H2). Intermediate problems are mostly minor mistakes that are overlooked. The overall code quality is average, the code base contains TODO, unused code, and the project is not fully covered in the NatSpec documentation.

Ackee Blockchain Security recommends Rhinestones.

  • Fix newly deployed safety argument possibilities,
  • protect Safe7579.initializeAccount front running function,
  • Fix the context withRegistry modifier Safe7579.executeFromExecutor function,
  • Fix SIG hook override,
  • solve a problem success Return value when executing batch,
  • calling module onInstall function while _initModule process,
  • Resolve all TODOs and remove unused code.
  • Cover your code base with NatSpec documents,
  • Addresses all other reported issues.
  • We also recommend that you conduct ongoing internal peer code reviews.

Ackee Blockchain Security’s full Rhinestone Audit report, which includes a detailed description of all findings and recommendations, can be found here.

We were delighted to appreciate Rhinestone and look forward to working together again.

Share. Facebook Twitter Pinterest LinkedIn Tumblr Email

Related Posts

Encryption Inheritance Update: June 2025

June 25, 2025

HyperLend Protocol Thanksgiving Summary -Ackee Blockchain

June 21, 2025

Encryption inheritance: Roundup -February 20125

June 19, 2025
Add A Comment

Comments are closed.

Recent Posts

CARV’s New Roadmap Signals Next Wave Of Web3 AI

June 27, 2025

CARV’s New Roadmap Signals Next Wave Of Web3 AI

June 27, 2025

Bybit Expands Global Reach With Credit Card Crypto Purchases In 25+ Currencies And Cashback Rewards

June 27, 2025

BYDFi Joins Seoul Meta Week 2025, Advancing Web3 Vision And South Korea Strategy

June 27, 2025

Earns $9,800 Per Day With BTC Breaks Through $107,000, GoldenMining Global Market.

June 27, 2025

Why Bakkt Holdings can buy Bitcoin with a $ 1 billion increase

June 27, 2025

NVIDIA RTX strengthens FITY’s AI -centered innovation in Cooler Design.

June 27, 2025

Join Earn Mining To Mine Easily And Earn $7752 A Day

June 26, 2025

Bitcoin prices return to green -building exercise for more profits

June 26, 2025

Weed® Announces Partnership With Khalifa Kush; Launches Global Commercialization

June 26, 2025

GBM Launches Auction Festival With The Sandbox, Aavegotchi, Unstoppable Domains, And More

June 26, 2025

Crypto Flexs is a Professional Cryptocurrency News Platform. Here we will provide you only interesting content, which you will like very much. We’re dedicated to providing you the best of Cryptocurrency. We hope you enjoy our Cryptocurrency News as much as we enjoy offering them to you.

Contact Us : Partner(@)Cryptoflexs.com

Top Insights

CARV’s New Roadmap Signals Next Wave Of Web3 AI

June 27, 2025

CARV’s New Roadmap Signals Next Wave Of Web3 AI

June 27, 2025

Bybit Expands Global Reach With Credit Card Crypto Purchases In 25+ Currencies And Cashback Rewards

June 27, 2025
Most Popular

Encryption fear and greed index falls to 21: Meaning of the market

March 14, 2025

Kadena Announces Annelis Osborne as Chief Business Officer

April 26, 2024

The founder of Solana slams Trump’s strategic protection area. The reason is as follows

March 7, 2025
  • Home
  • About Us
  • Contact Us
  • Disclaimer
  • Privacy Policy
  • Terms and Conditions
© 2025 Crypto Flexs

Type above and press Enter to search. Press Esc to cancel.