Submission Details
Severity:
The address generation mechanism is vulnerable to address colisions.
Relevant links
Summary
The address generation mechanism in GenerateAddress is vulnerable to address colision
Vulnerability Details
To determine an address, we execute the following line address(uint160(uint256(keccak256(abi.encode(_id, "maker")))));. I'd like to bring our attention to the following piece of code used in here.
`address(uint160(uint256(...)))`
We can notice that, we're casting a uint256 to uint160. This can lead to silent overflows which can result in 2 ids having
function generateMakerAddress(uint256 _id) internal pure returns (address) {
return address(uint160(uint256(keccak256(abi.encode(_id, "maker")))));
}
Impact
Tools Used
Recommendations
Prize pool breakdown
Total prize
30,000 USDC
nSLOC
1,22924 USDC / LOC
25,000 USDC
2,750 USDC
2,250 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.