This repository was archived by the owner on Jan 9, 2025. It is now read-only.
This repository was archived by the owner on Jan 9, 2025. It is now read-only.
bug: Kakarot precompiles can be abused by malicious contracts by delegate-calling whitelisted contracts[2] #1562
Closed
Description
Bug Report
Malicious contracts can exploit users to make arbitrary calls to whitelisted contracts on their behalf via delegatecall
code-423n4/2024-09-kakarot-findings#38
Fix to implement
Make sure that DualVmToken, L2KakarotMessaging, as well as any other future contract using Kakarot precompiles, make extensive use of noDelegateCall modifiers.