# Remove owner calls can be replayed to remove a different owner at the same index, leading to severe issues when combined with lack of last owner guard

CoinbaseSmartWallet's removeOwnerAtIndex is replayable cross-chain, so a signature removing owner at index 0 can delete a different owner on another chain, potentially bricking the account.

- Payout: Contest reward
- Severity: high
- Program: Coinbase
- Credited: Circolors
- Disclosed: 2024-05-01
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2024-03-coinbase-findings/issues/114
- Library page: https://bugbountylibrary.com/r/c4%3A2024-03-coinbase%3AH-01
- Tags: domain:web3 impact:dos impact:integrity kind:contest platform:code4rena sev:high tech:evm technique:chained vuln:access-control vuln:business-logic vuln:signature-replay

**Target:** ERC-4337 smart account owner management (MultiOwnableStorage)
**Root cause:** removeOwnerAtIndex identifies the owner to remove only by index, but owner mappings differ across chains; a signature replayed via executeWithoutChainIdValidation removes whatever owner sits at that index on the target chain. No last-owner guard prevents removing the final owner.
**Steps:**
1. Alice adds an owner on all chains via `executeWithoutChainIdValidation` (replayable, no chainId check).
2. Alice signs a cross-chain replayable call to `removeOwnerAtIndex(0)` to remove her initial owner.
3. Attacker or Alice replays the same signature on Arbitrum/Avalanche where index 0 maps to a different owner.
4. On a chain where index 0 is the only accessible owner, the account is permanently locked.
**How found:** Reasoned about divergence of owner mappings across chains when mixing direct `execute` and replayable `executeWithoutChainIdValidation` owner changes, then noted index-based removal plus no last-owner guard.
**Exploitation:** Anyone can take the user's cross-chain replayable removeOwnerAtIndex signature and submit it on other chains, removing a different owner at the same index; combined with the missing last-owner guard this can strip the sole owner and brick the account.
**Escalation:** Chaining replayable signature with lack of last-owner guard escalates from unintended owner removal to permanent account lockout.
**Insight:** When a function is replayable cross-chain, any index- or position-based parameter can resolve to a different entity on another chain; check whether removal/update functions should key on identity rather than index.