Summary

When calldata is less than 4 bytes long, calls may be incorrectly routed to an unintended fallback handler.

Vulnerability Details

To determine the matching fallback handler, the fallback() function extracts the first 4 bytes of the calldata and looks up the fallback handler by its selector.

The implementation uses msg.sig, which returns the first 4 bytes of the calldata, according to Solidity's documentation.

msg.sig (bytes4): first four bytes of the calldata (i.e. function identifier)

However, the function doesn't validate that the calldata is at least 4 bytes long. When calldata is shorter than 4 bytes, msg.sig wil pad the missing bytes with zeros.

Impact

Calls may be incorrectly routed to an unintended fallback handler when calldata is shorter than 4 bytes.

Tools Used

None.

Recommendations

Ensure that the calldata length is at least 4 bytes.