# Limitations for Users Employing Multi-sig or Account Abstraction Wallets in Setting Delegate Address Low/Info · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-L02 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description Within the Delegatable::setDelegate() function, [there](https://github.com/0xOstium/smart-contracts-threeSigma/blob/1b70cffbac621d39e321c159e45c048b703add92/src/OstiumTradingCallbacks.sol#L274) exists a check to determine if a contract is executing the function, restricting the action solely to Externally Owned Accounts (EOAs). However, this approach may pose issues for users utilizing multi-sig or account abstraction wallets [(ERC-4337](https://eips.ethereum.org/EIPS/eip-4337)). Additionally, in accordance with [EIP 3074](https://eips.ethereum.org/EIPS/eip-3074#abstract), which introduces the AUTH and AUTHCALL EVM instructions, the first one sets a context variable authorized based on an ECDSA signature and the second one sends a call as the authorized account, allowing for the delegation of control from an EOA to a smart contract. As a result, relying on tx.origin to ensure msg.sender is an EOA may not remain valid if EIP 3074 is implemented. ### Recommendation Consider entirely removing this check, as there is a significant likelihood of users employing the mentioned wallets or new EIPs, potentially disrupting the introduced logic. ### Status Acknowledged --- Related findings: - [Signature Replay attack possible on `updateWorkerDeploymentConfigWithSig()` in Blueprintcore.sol which leads to users lose the funds](https://0xsimao.com/findings/crestal-network-signature-replay-blueprintcore-lose): Crestal Network - [`PreDepositVault::sweep()` uses `address.transfer` which does not work for certain wallets](https://0xsimao.com/findings/gaib-deposit-sweep-transfer-wallets): GAIB Pre-Vaults - [Halted withdrawals in BatchOut due to setting withdrawTo to address(0) in scheduleWithdrawal()](https://0xsimao.com/findings/clip-finance-i-withdrawals-withdraw-schedule-withdrawal): Clip Finance Strategies - [Malicious users can DOS the protocol by setting downsideProtected to a large value](https://0xsimao.com/findings/autonomint-dos-downside-protected-large): Autonomint