T05 · Unauthorized Access and Privilege Escalation
Error
- Location
src/server.ts:634- Finding
Unauthenticated Facilitator Endpoint Allows Unauthorized Gas Sponsorship
- Content
View full analysis
{ try { const { paymentPayload, paymentRequirements } = req.body; const result = await facilitatorSettle(paymentPayload, paymentRequirements); res.json(result); } catch (err: any) { res.json({ success: false, error: err.message, }); } }); ``` ```ts // src/facilitator.ts:218-259 export async function settle( paymentPayload: PaymentPayload, paymentRequirements: PaymentRequirements ): Promise { try { const { walletClient, publicClient } = getSignerWallet(); const { authorization, signature } = paymentPayload.payload; const { v, r, s } = parseSignature(signature); console.log('[facilitator] Settling payment...'); console.log(` From: ${authorization.from}`); console.log(` To: ${authorization.to}`); console.log(` Value: ${authorization.value} (${Number(authorization.value) / 1e6} USDC)`); const hash = await walletClient.writeContract({ address: USDC_ADDRESS, abi: TRANSFER_WITH_AUTH_ABI, functionName: 'transferWithAuthorization', args: [ authorization.from as `0x${string}`, authorization.to as `0x${string}`, BigInt(authorization.value), BigInt(authorization.validAfter), BigInt(authorization.validBefore), authorization.nonce as `0x${string}`, v, r, s, ], }); console.log(`[facilitator] Tx submitted: ${hash}`); const receipt = await publicClient.waitForTransactionReceipt({ hash }); if (receipt.status === 'success') { console.log(`[facilitator] ✓ Payment settled: ${hash}`); return { success: true, txHash: hash }; } else { console. ...[truncated 2310 chars]- Remediation
View remediation