ArkProject: NFT Bridge
ArkProject
NFTBridge
60,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Out-of-bounds memory access in `cairoStringUnpack` function

akay

Summary

The cairoStringUnpack function in the Cairo library has a potential out-of-bounds memory access issue when handling the pending word. This can lead to unexpected behavior or crashes if the function tries to access memory outside the allocated buffer.

Vulnerability Details

Looking at the cairoStringUnpack function, it processes a packed Cairo string and unpacks it into a standard string. After processing the main part of the string, the function increments the offset by dataLen and then tries to access buf[offset + 1] to get the number of characters in the pending word. If offset + 1 exceeds the length of the buffer, this will result in an out-of-bounds memory access.

function cairoStringUnpack(
uint256[] memory buf,
uint256 offset
)
internal
pure
returns (string memory)
{
string memory s;
uint256 dataLen = buf[offset];
offset += 1;
for (uint256 i = offset; i < (offset + dataLen); ++i) {
s = string.concat(s, uint256AsciiNbcharsToString(buf[i], uint8(CAIRO_STR_LEN)));
}
offset += dataLen;
// handle pending word
uint8 nbChars = uint8(buf[offset + 1] & 0xFF);
s = string.concat(s, uint256AsciiNbcharsToString(buf[offset], nbChars));
return s;
}

Impact

If offset + 1 exceeds the length of the buffer, the function will attempt to access memory outside the allocated buffer. This can lead to unexpected behavior, crashes, or potential security vulnerabilities.

Tools Used

  • Manual code review

Recommendations

Add a check to ensure that offset + 1 is within the bounds of the buffer before accessing it.

function cairoStringUnpack(
uint256[] memory buf,
uint256 offset
)
internal
pure
returns (string memory)
{
string memory s;
uint256 dataLen = buf[offset];
offset += 1;
for (uint256 i = offset; i < (offset + dataLen); ++i) {
s = string.concat(s, uint256AsciiNbcharsToString(buf[i], uint8(CAIRO_STR_LEN)));
}
offset += dataLen;
// handle pending word if it exists
if (offset < buf.length - 1) {
uint8 nbChars = uint8(buf[offset + 1] & 0xFF);
s = string.concat(s, uint256AsciiNbcharsToString(buf[offset], nbChars));
}
return s;
}

This check ensures that the function does not attempt to access memory outside the bounds of the buffer, thereby addressing the logic issue.

Updates

Lead Judging Commences

n0kto Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational / Gas

Please, do not suppose impacts, think about the real impact of the bug and check the CodeHawks documentation to confirm: https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity A PoC always helps to understand the real impact possible.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.