Submission Details
Severity:
Missing contract-existence checks before low-level calls
Summary
Missing contract-existence checks before low-level calls
Vulnerability Details
Low-level calls return success if there is no code present at the specified address. In addition to the zero-address checks, add a check to verify that extcodesize() is non-zero.
File: src/Proxy.sol
53: assembly {
let ptr := mload(0x40)
calldatacopy(ptr, 0, calldatasize())
File: src/ProxyFactory.sol
250: (bool success,) = proxy.call(data);
if (!success) revert ProxyFactory__DelegateCallFailed();
Impact
Rewards might not be distributed
Tools Used
Manual
Recommendations
Add a check to verify that extcodesize() is non-zero.
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.