TSender

Cyfrin
DeFiFoundry
15,000 USDC
View results
Submission Details
Severity: medium
Invalid

The flaw lies in calculating the end index for the loop iterating through the recipients array.

Incorrect End Index Calculation:

The line let end := add(recipients.offset, shl(5, recipients.length)) calculates the end index by shifting recipients.length left by 5 bits (shl(5, recipients.length)) and adding it to the recipients.offset.
The intended purpose seems to be calculating the memory offset of the last element in the recipients array.

Flaw in Shifting Operation:

The problem lies in the shifting operation (shl(5, recipients.length)).
While a single address occupies 32 bytes in memory, shifting recipients.length by 5 bits only multiplies it by 32 if recipients.length is guaranteed to be a multiple of 32.
If the recipients.length has a remainder when divided by 32 (i.e., the array has a size that isn't a perfect multiple of 32 elements), the shifting operation will not produce the correct offset for the last element.

Potential Consequences:

In cases where the recipients.length isn't a multiple of 32, the calculated end index will be incorrect. This could lead to the loop:
Iterating through fewer elements than intended (missing recipients).
Attempting to access memory outside the bounds of the recipients array (potential out-of-bounds error or unexpected behavior).

Updates

Lead Judging Commences

inallhonesty Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.