60,000 USDC
Submission Details
Severity:
Use of `abi.encodePacked` with dynamic types inside `keccak256`
Vulnerability Details
abi.encodePacked should not be used with dynamic types when passing the result to a hash function such as keccak256.
function requestHash(
uint256 salt,
address collection,
snaddress toL2Address,
uint256[] memory tokenIds
)
internal
pure
returns (uint256)
{
bytes32 hash = keccak256(
abi.encodePacked(
salt,
// Cairo uses felts, which are converted into u256 to compute keccak.
// As we use abi.encodePacked, we want the address to also be 32 bytes long.
uint256(uint160(collection)),
snaddress.unwrap(toL2Address),
tokenIds
)
);
return uint256(hash);
}
Impact
use of abi.encodePacked could lead to hash collisions
Recommendations
Use abi.encode() instead which will pad items to 32 bytes, which will prevent hash collisions
Updates
Lead Judging Commences
n0kto 9 months ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
invalid-encodePacked-collision-known-issue
Known issue: lightchaser
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.