T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:7
- Finding
- Unauthenticated Control of Server-Managed Wallet Operations## Vulnerability Details **File Location**: `SKILL.md:7-12`, with affected financial operations documented at `SKILL.md:190-206`, `SKILL.md:323-341`, and `SKILL.md:447-473` **Vulnerability Type**: Missing caller authentication and agent ownership authorization **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:7-12`: ```markdown **API Base URL:** ``` https://uxkikwwngosiiownhttr.supabase.co/functions/v1/api ``` **No authorization header required** — the proxy handles authentication internally. ``` `SKILL.md:190-206`: ```markdown ### Request Body ```json { "agent_id": "550e8400-e29b-41d4-a716-446655440000" } ``` | Field | Type | Required | Description | |-------|------|----------|-------------| | `agent_id` | UUID | ✅ Yes | Agent ID from `/join` response | ### curl ```bash curl -X POST https://uxkikwwngosiiownhttr.supabase.co/functions/v1/api/swap \ -H "Content-Type: application/json" \ -d '{"agent_id": "550e8400-e29b-41d4-a716-446655440000"}' ``` ``` The documented swap behavior includes: ```markdown 4. Sends tx via Privy server-side wallet RPC (`eth_sendTransaction` on `eip155:8453`) ``` `SKILL.md:447-473`: ```markdown | `feeRecipient` | object | ❌ No | Fee routing (defaults to agent wallet). `{ "type": "wallet", "value": "0x..." }` | | `simulateOnly` | boolean | ❌ No | When `true`, returns predicted address without broadcasting | ### curl ```bash curl -X POST https://uxkikwwngosiiownhttr.supabase.co/functions/v1/api/deploy-token \ -H "Content-Type: application/json" \ -d '{"agent_id": "550e8400-e29b-41d4-a716-446655440000", "tokenName": "My Agent Token", "tokenSymbol": "MAT"}' ``` ### What Happens 1. Moves agent to DeFi zone with status `"Deploying token via Bankr 🚀"` 2. Calls Bankr Deploy API (`POST https://api.bankr.bot/token-launches/deploy`) 3. Fees default to agent's wallet address 4. Logs `deploy_token` action with token add ...[truncated 3549 chars]
- Remediation
- ## Remediation Suggestions 1. **Require client authentication** - Require a validated user session, OAuth token, API key, or equivalent credential on every non-public endpoint. - Do not rely on the backend's Privy or Bankr credentials as proof that the external caller is authorized. 2. **Enforce object-level authorization** - Bind every `agent_id` to an authenticated owner or tenant. - Before reading state or initiating a transaction, verify that the authenticated principal is authorized to control that specific agent. - Return a generic `404` or `403` response for unauthorized agent references. 3. **Require transaction-specific consent** - Use signed challenges containing the chain ID, wallet address, target contract, function, amount, nonce, expiration time, and intended recipient. - Display and require explicit confirmation for swaps, approvals, deposits, deployments, and fee-recipient changes. - Prevent a general session token from silently authorizing unrestricted wallet transactions. 4. **Introduce scoped capabilities** - Issue short-lived, single-use authorization tokens scoped to one agent, one endpoint, and strict amount limits. - Add nonce validation, expiration, and replay protection. - Apply per-agent and per-user rate limits and spending limits. 5. **Restrict caller-controlled transaction parameters** - Default `feeRecipient` to the verified agent wallet. - Reject alternate fee recipients unless separately authenticated and explicitly approved by the wallet owner. - Allowlist chain IDs, contracts, methods, tokens, vaults, and maximum amounts on the server. 6. **Protect identifiers and operational data** - Treat UUIDs only as identifiers, never as bearer secrets. - Avoid exposing Privy user IDs and unnecessary wallet metadata in action-history responses. - Redact agent IDs and transaction-control metadata from logs where they are not required. 7. **A ...[truncated 670 chars]