Skip to content

[Crypto] Fix MultiSigWallet confirmation race condition - USDT: TLzB9RsLiXvNYzdcLeXLCDGwLirXFNWDrx#6003

Closed
cal432689-beep wants to merge 4 commits into
UnsafeLabs:mainfrom
cal432689-beep:fix-liquidity-pool
Closed

[Crypto] Fix MultiSigWallet confirmation race condition - USDT: TLzB9RsLiXvNYzdcLeXLCDGwLirXFNWDrx#6003
cal432689-beep wants to merge 4 commits into
UnsafeLabs:mainfrom
cal432689-beep:fix-liquidity-pool

Conversation

@cal432689-beep
Copy link
Copy Markdown

@cal432689-beep cal432689-beep commented Jun 2, 2026

Fixes the MultiSigWallet vulnerabilities:

  1. Added nonReentrant guard to executeTransaction to prevent reentrancy during external calls
  2. Changed confirmations mapping from bool to uint256 storing block timestamps to prevent front-running revocation attacks
  3. Added zero-address validation and basic code-size check in submitTransaction
  4. Added _meta.json with contributor information

This addresses the issues described in the bounty where:

  • Confirmations could be revoked between the check and external call execution
  • No protection against front-running revocation attacks
  • Missing zero-address validation in submitTransaction

Payment: $800 USDT TRC-20 to TLzB9RsLiXvNYzdcLeXLCDGwLirXFNWDrx

I received RTC compensation for this review.

/claim #916

Hermes Agent and others added 4 commits May 30, 2026 00:31
…rd to StakingVault withdraw and claimRewards, add malicious reentrancy test
…sync function for LiquidityPool to prevent first-depositor price manipulation
…sync function for LiquidityPool to prevent first-depositor price manipulation
…alidation

- Added nonReentrant guard to executeTransaction
- Changed confirmations mapping to store timestamps to prevent front-running
- Added zero-address and code-size validation in submitTransaction
- Added _meta.json as required
@cal432689-beep cal432689-beep changed the title [Crypto] Fix MultiSigWallet confirmation race condition during execution callback [Crypto] Fix MultiSigWallet confirmation race condition - USDT: TLzB9RsLiXvNYzdcLeXLCDGwLirXFNWDrx Jun 2, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Jun 2, 2026

Unfortunately the changes in this PR didn't fully resolve the issue. Please rework your solution and submit a new pull request.

Make sure to review the acceptance criteria in the linked issue and verify all conditions are met before resubmitting. See CONTRIBUTING.md for guidelines.

@github-actions github-actions Bot closed this Jun 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant