Submission Details
Severity:
Missing extcodesize check in proxy
Summary
Missing extcodesize check in proxy
Vulnerability Details
The target contract is resolved inside the fallback function. It may return address(0).
Impact
The target contract is resolved inside the fallback function. It may return address(0).
address implementation = _implementation;
assembly {
let ptr := mload(0x40)
calldatacopy(ptr, 0, calldatasize())
let result := delegatecall(gas(), implementation, ptr, calldatasize(), 0, 0)
let size := returndatasize()
returndatacopy(ptr, 0, size)
switch result
case 0 { revert(ptr, size) }
default { return(ptr, size) }
}
}
Tools Used
Manual Review
Recommendations
Before delegate-calling into the target contract, check if it exists.
codeSize := extcodesize(\_target)
}
require(codeSize > 0);
Prize pool breakdown
Total prize
15,000 USDC
nSLOC
19477 USDC / LOC
14,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.