GivingThanks

Root Cause and Impact

• Root Cause: Using abi.encodePacked with dynamic types can cause data collisions, especially when concatenated for hashing or encoding.

• Impact: Potential for hash collisions, leading to incorrect token URIs or vulnerabilities if used in security-critical contexts.

Vulnerability Details

• Code Snippet:

  string memory json = string(

  abi.encodePacked(

  '{"donor":"',

  Strings.toHexString(uint160(donor), 20),

  '","date":"',

  Strings.toString(date),

  '","amount":"',

  Strings.toString(amount),

  '"}'

  )

  );

  • Issue: abi.encodePacked concatenates data without padding, risking collisions.

  • Consequence: May result in incorrect or maliciously crafted metadata.

Recommendations

• Use abi.encode Instead:

  string memory json = string(

  abi.encode(

  '{"donor":"',

  Strings.toHexString(uint160(donor), 20),

  '","date":"',

  Strings.toString(date),

  '","amount":"',

  Strings.toString(amount),

  '"}'

  )

  );

• Alternatively, Use String Concatenation Functions:

  • Use Solidity's string concatenation or helper libraries for safer operations.