60,000 USDC
Submission Details
Severity:
Unsafe Casting
Summary
Downcasting in Solidity can be unsafe due to the potential for data loss and unintended behavior.
Vulnerability Details
unsafe casting:
byteString[i] = bytes1(uint8(asciiValue));
function uint256AsciiNbcharsToString(
uint256 value,
uint8 length
)
internal
pure
returns (string memory)
{
string memory s = new string(length);
bytes memory byteString = bytes(s);
// cairo string is 31 bytes with first character as higher bit
for (uint256 i = 0; i < length; ++i) {
uint256 asciiValue = (value >> (8 * (length - 1 - i))) & 0xFF;
@> byteString[i] = bytes1(uint8(asciiValue)); // @audit --> Unsafe Casting
}
return s;
}
Impact
data loss and unintended behavior.
Tools Used
manual review
Recommendations
Use OpenZeppelin's SafeCast library
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.