bug: Kakarot precompiles can be abused by malicious contracts by delegate-calling whitelisted contracts[2]
Closed this issue · 1 comments
obatirou commented
Bug Report
Malicious contracts can exploit users to make arbitrary calls to whitelisted contracts on their behalf via delegatecall
code-423n4/2024-09-kakarot-findings#38
Fix to implement
Make sure that DualVmToken, L2KakarotMessaging, as well as any other future contract using Kakarot precompiles, make extensive use of noDelegateCall modifiers.