Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Missing extcodesize check in proxy Won't Fix

samshz

Description

Distributor dynamically retrieves the currently set delegate from the centralized ProxyStorage contract. The target contract (delegate) is resolved inside the fallback function. It may return address(0). ProxyStorage does not enforce that the requested settings key exists, which may lead to Distributor delegate-calling into address(0), which returns no error. This might stay undetected when calling as the method does not return a value, which is consistent with calling a target address with no code.

fallback() external {
address implementation = _implementation;
assembly {
let ptr := mload(0x40)
calldatacopy(ptr, 0, calldatasize())
let result := delegatecall(gas(), implementation, ptr, calldatasize(), 0, 0)
let size := returndatasize()
returndatacopy(ptr, 0, size)
​
switch result
case 0 { revert(ptr, size) }
default { return(ptr, size) }
}

https://github.com/Cyfrin/2023-08-sparkn/blob/main/src/Proxy.sol#L51-L63

Recommendation

Before delegate-calling into the target contract, check if it exists.

assembly {
codeSize := extcodesize(_target)
}
require(codeSize > 0);

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.