T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:7- Finding
Unauthenticated Control of Server-Managed Wallet Operations
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:7-12, with affected financial operations documented atSKILL.md:190-206,SKILL.md:323-341, andSKILL.md:447-473
Vulnerability Type: Missing caller authentication and agent ownership authorization
Risk Level: HighVulnerable Code Snippets
SKILL.md:7-12:markdown **API Base URL:**https://uxkikwwngosiiownhttr.supabase.co/functions/v1/api
text **No authorization header required** — the proxy handles authentication internally.SKILL.md:190-206:markdown ### Request Body ```json { "agent_id": "550e8400-e29b-41d4-a716-446655440000" }Field Type Required Description agent_idUUID ✅ Yes Agent ID from /joinresponsecurl
bash curl -X POST https://uxkikwwngosiiownhttr.supabase.co/functions/v1/api/swap \ -H "Content-Type: application/json" \ -d '{"agent_id": "550e8400-e29b-41d4-a716-446655440000"}'text The documented swap behavior includes: ```markdown 4. Sends tx via Privy server-side wallet RPC (`eth_sendTransaction` on `eip155:8453`)SKILL.md:447-473:markdown | `feeRecipient` | object | ❌ No | Fee routing (defaults to agent wallet). `{ "type": "wallet", "value": "0x..." }` | | `simulateOnly` | boolean | ❌ No | When `true`, returns predicted address without broadcasting | ### curl ```bash curl -X POST https://uxkikwwngosiiownhttr.supabase.co/functions/v1/api/deploy-token \ -H "Content-Type: application/json" \ -d '{"agent_id": "550e8400-e29b-41d4-a716-446655440000", "tokenName": "My Agent Token", "tokenSymbol": "MAT"}'What Happens
- Moves agent to DeFi zone with status
"Deploying token via Bankr 🚀" - Calls Bankr Deploy API (
POST https://api.bankr.bot/token-launches/deploy) - Fees default to agent's wallet address
- Logs
deploy_tokenaction with token add ...[truncated 3549 chars]
- Moves agent to DeFi zone with status
- Remediation
View remediation
Remediation Suggestions
-
Require client authentication
- Require a validated user session, OAuth token, API key, or equivalent credential on every non-public endpoint.
- Do not rely on the backend's Privy or Bankr credentials as proof that the external caller is authorized.
-
Enforce object-level authorization
- Bind every
agent_idto an authenticated owner or tenant. - Before reading state or initiating a transaction, verify that the authenticated principal is authorized to control that specific agent.
- Return a generic
404or403response for unauthorized agent references.
- Bind every
-
Require transaction-specific consent
- Use signed challenges containing the chain ID, wallet address, target contract, function, amount, nonce, expiration time, and intended recipient.
- Display and require explicit confirmation for swaps, approvals, deposits, deployments, and fee-recipient changes.
- Prevent a general session token from silently authorizing unrestricted wallet transactions.
-
Introduce scoped capabilities
- Issue short-lived, single-use authorization tokens scoped to one agent, one endpoint, and strict amount limits.
- Add nonce validation, expiration, and replay protection.
- Apply per-agent and per-user rate limits and spending limits.
-
Restrict caller-controlled transaction parameters
- Default
feeRecipientto the verified agent wallet. - Reject alternate fee recipients unless separately authenticated and explicitly approved by the wallet owner.
- Allowlist chain IDs, contracts, methods, tokens, vaults, and maximum amounts on the server.
- Default
-
Protect identifiers and operational data
- Treat UUIDs only as identifiers, never as bearer secrets.
- Avoid exposing Privy user IDs and unnecessary wallet metadata in action-history responses.
- Redact agent IDs and transaction-control metadata from logs where they are not required.
-
**A ...[truncated 670 chars]
-