Storage Proofs
Curve
DeFiLayer 1Layer 2
14,723 OP
View results
Previous Next
Submission Details
Severity: low
Invalid

Missing RLP Length Validation For Proofs

pacelli

Summary

ScrvusdVerifierV1::_extractParametersFromProof and ScrvusdVerifierV2::_extractPeriodFromProof functions use the RLPReader library to parse RLP-encoded nodes in the Ethereum trie, but when parsing a bytes string as a RLPItem there is no check to verify the length of the specified RLP encoding matches the actual length of the payload.

Vulnerability Details

Let's see the following example:

function test_incorrect_encoding() public pure {
RLPReader.RLPItem memory item = RLPReader.toRlpItem("\xc3\xd0");
RLPReader.RLPItem[] memory list = RLPReader.toList(item);
assertEq(RLPReader.toBytes(list[0]).length, 16);
}

toRlpItem should've reverted because the encoded length of three bytes is larger than the length of the payload. Then toList access the malformed data and encodes to 16 bytes, which is also larger than the underlying payload.

Recommendations

Add a check in both functions of the verifiers to validate the length of the proof matches the expected length of prefix + payload based on the encoded prefix.

Updates

Lead Judging Commences

0xnevi Lead Judge
6 months ago
0xnevi Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.