alchemyplatform/modular-account · Security
Alchemy Non-SMA and Webauthn Account Security Advisory
- GHSA ID
- GHSA-56r6-ccm5-8hg3
- Severity
- high
- Published
- Updated
- CVSS v4
- 8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Description
Impact
A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted.
Patches
Please direct creation of new wallets to either createSemiModularAccount on AccountFactory.sol or createWebAuthnAccount on WebAuthnFactory.sol.
CWEs
- CWE-287 · Improper Authentication
References
- https://github.com/alchemyplatform/modular-account/security/advisories/GHSA-56r6-ccm5-8hg3 ↗
- https://github.com/alchemyplatform/aa-sdk/commit/b343437a9e4a833c25fed7bc8785a815cbbae0ee ↗
- https://github.com/alchemyplatform/modular-account/commit/2352c9b692935ba97d98619cb31ba1653eee241f ↗
- https://github.com/advisories/GHSA-56r6-ccm5-8hg3 ↗