Submission Details
Severity:
`verifyCopyByteIndex` and `verifyPasteByteIndex` isn't enough for verifying data copy and paste
Summary
verifyCopyByteIndex and verifyPasteByteIndex isn't enough for verifying data copy and paste
Vulnerability Details
function verifyCopyByteIndex(uint256 copyByteIndex, bytes memory copyFromData) internal pure {
require(C.SLOT_SIZE <= copyByteIndex, "LibBytes: copyByteIndex too small");
require(copyByteIndex <= copyFromData.length, "LibBytes: copyByteIndex too large");
}
function verifyPasteByteIndex(uint256 pasteByteIndex, bytes memory pasteToData) internal pure {
require(C.SLOT_SIZE <= pasteByteIndex, "LibBytes: pasteByteIndex too small");
require(pasteByteIndex <= pasteToData.length, "LibBytes: pasteByteIndex too large");
}
bytes memory variables in Solidity have an additional 32 bytes of overhead for storing the array length. So we need to verify data.length >= index + 32.
Impact
Even though the verify of verifyCopyByteIndex and verifyPasteByteIndex passes, the paste32Bytes function maybe still revert.
Tools Used
manual
Recommendations
function verifyCopyByteIndex(uint256 copyByteIndex, bytes memory copyFromData) internal pure {
require(C.SLOT_SIZE <= copyByteIndex, "LibBytes: copyByteIndex too small");
- require(copyByteIndex <= copyFromData.length, "LibBytes: copyByteIndex too large");
+ require(copyByteIndex + 32 <= copyFromData.length, "LibBytes: copyByteIndex too large");
}
function verifyPasteByteIndex(uint256 pasteByteIndex, bytes memory pasteToData) internal pure {
require(C.SLOT_SIZE <= pasteByteIndex, "LibBytes: pasteByteIndex too small");
- require(pasteByteIndex <= pasteToData.length, "LibBytes: pasteByteIndex too large");
+ require(pasteByteIndex + 32 <= pasteToData.length, "LibBytes: pasteByteIndex too large");
}
Prize pool breakdown
Total prize
250,000 USDC
nSLOC
12,28520 USDC / LOC
220,000 USDC
10,000 USDC
20,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.