ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Free Memory Pointer is updated incorrectly in `TokenUtils::_callBaseUri()`

alqaqa

Vulnerability Details

When we get the base URI, we modify the free memory pointer. Then, return it to the correct value, but handling it is not 100% correct.

TokenUtil.sol#L156-L164

if success {
returnSize := returndatasize()
returnValue := mload(0x00)
1: ret := mload(0x40)
2: mstore(ret, returnSize)
3: returndatacopy(add(ret, 0x20), 0, returnSize)
// update free memory pointer
4: mstore(0x40, add(add(ret, 0x20), add(returnSize, 0x20)))
}

  1. We store the Free memory pointer value in ret (preserve it)

  2. We stored the size of the returned data (+ 0x20)

  3. Copying the returned data into memory (+ returned data length)

  4. When we update the free memory pointer we will find that it is updated like this:

FMP = old FMP value + 0x20 + returnSize + 0x20

So we are adding an additional 0x20 without reason as the value should be increased by 0x20 + returnSize not 0x20 + returnSize + 0x20.

Impact

Incorrect Memory Managment.

Tools Used

Foundry Debugger

Recommendations

Don't add this excessive 0x20 value.

diff --git a/apps/blockchain/ethereum/src/token/TokenUtil.sol b/apps/blockchain/ethereum/src/token/TokenUtil.sol
index 41cc17d..7054cfc 100644
--- a/apps/blockchain/ethereum/src/token/TokenUtil.sol
+++ b/apps/blockchain/ethereum/src/token/TokenUtil.sol
@@ -160,7 +160,7 @@ library TokenUtil {
mstore(ret, returnSize)
returndatacopy(add(ret, 0x20), 0, returnSize)
// update free memory pointer
- mstore(0x40, add(add(ret, 0x20), add(returnSize, 0x20)))
+ mstore(0x40, add(add(ret, 0x20), returnSize))
}
}
if (success && returnSize >= 0x20 && returnValue > 0) {
Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.