60,000 USDC
Submission Details
Severity:
Use of `abi.encodePacked` with dynamic types inside `keccak256`
Vulnerability Details
abi.encodePacked should not be used with dynamic types when passing the result to a hash function such as keccak256.
function requestHash(
uint256 salt,
address collection,
snaddress toL2Address,
uint256[] memory tokenIds
)
internal
pure
returns (uint256)
{
bytes32 hash = keccak256(
abi.encodePacked(
salt,
// Cairo uses felts, which are converted into u256 to compute keccak.
// As we use abi.encodePacked, we want the address to also be 32 bytes long.
uint256(uint160(collection)),
snaddress.unwrap(toL2Address),
tokenIds
)
);
return uint256(hash);
}
Impact
use of abi.encodePacked could lead to hash collisions
Recommendations
Use abi.encode() instead which will pad items to 32 bytes, which will prevent hash collisions
Updates
Lead Judging Commences
n0kto about 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
invalid-encodePacked-collision-known-issue
Known issue: lightchaser
Prize pool breakdown
Total prize
60,000 USDC
nSLOC
2,30126 USDC / LOC
50,000 USDC
5,500 USDC
4,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.