`abi.encodePacked()` should not be used with dynamic types when passing the result to a hash function such as k`eccak256()`
Summary: If you use keccak256(abi.encodePacked(a, b)) and both a and b are dynamic types, it is easy to craft collisions in the hash value by moving parts of a into b and vice-versa. Unless there is a compelling reason, abi.encode should be preferred. If there is only one argument to abi.encodePacked() it can often be cast to bytes() or bytes32() instead. If all arguments are strings and or bytes, bytes.concat() should be used instead.
-
Found in line #106
SoulboundProfileNFT.sol(src/SoulboundProfileNFT.sol)abi.encodePacked( -
Found in line #110
SoulboundProfileNFT.sol(src/SoulboundProfileNFT.sol)abi.encodePacked(
Impact: If the encoded data is used for unique identifiers, access control, or logic branching, due to hash collision it could result in fund loss
Recommended Mitigation: Use abi.encode() instead which will pad items to 32 bytes, which will prevent hash collisions.
Appeal created
Informational or Gas
Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelyhood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.
Rewards breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.