60,000 USDC
Submission Details
Severity:
Off by one error DOS
Summary
Modulus used for computation in Starknet. This is the maximum value.
confirmed as the max value in:
Its is the maximum value and not the "maximum value + 1". Implementation is off by one.
Impact
Due to this off by one error, there will be a complete DOS on user. ie snaddress user = Cairo.snaddressWrap(SN_MODULUS); will not be able to use the service completely.
Hence any asset he owns will be permanently stuck accross bridge
Tools Used
foundry
Recommendations
function isFelt252(
uint256 val
)
internal
pure
returns (bool)
{
+ return val <= SN_MODULUS;
- return val < SN_MODULUS;
}
POC
$ git diff
diff --git a/cairo.t.sol b/cairo.t.sol
index 4db400f..ed79706 100644
--- a/cairo.t.sol
+++ b/cairo.t.sol
// SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;
-import "forge-std/Test.sol";
+import {console, Test} from "forge-std/Test.sol";
import "../src/sn/Cairo.sol";
/**
contract CairoTest is Test {
assertFalse(Cairo.isFelt252(SN_MODULUS + 1));
assertTrue(Cairo.isFelt252(0));
assertTrue(Cairo.isFelt252(0x12345));
+ //Added test below
+ assertFalse(Cairo.isFelt252(SN_MODULUS)); //@audit off by one
}
//
contract CairoTest is Test {
vm.expectRevert();
Cairo.felt252Wrap(type(uint256).max);
+
+ vm.expectRevert();
+ Cairo.felt252Wrap(SN_MODULUS);
}
//
contract CairoTest is Test {
vm.expectRevert();
Cairo.snaddressWrap(type(uint256).max);
+
+ vm.expectRevert();
+ Cairo.snaddressWrap(SN_MODULUS);
}
//
contract CairoTest is Test {
}
}
+
(END)
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.