Submission Details
Impact:
Likelihood:
[M-6] _isValidSignature() does not check for errors during actualSigner calculation
[M-6] SnowmanAirdrop::_isValidSignature() does not check for errors during actualSigner calculation
Description
_isValidFunction()uses ECDSA interface to calculate signer from digest, v, r and sIt does not take account the errors that can be generated during validation
function _isValidSignature(address receiver, bytes32 digest, uint8 v, bytes32 r, bytes32 s)
internal
pure
returns (bool)
{
@> (address actualSigner,,) = ECDSA.tryRecover(digest, v, r, s);
return actualSigner == receiver;
}
Risk
Likelihood:
Whenever
tryRecover()returns an error
Impact:
Error not recognised and handled
Proof of Concept
This is the function signature of tryRecover():
function tryRecover(
bytes32 hash,
uint8 v,
bytes32 r,
bytes32 s
) internal pure returns (address recovered, RecoverError err, bytes32 errArg) {
It returns three objects - recovered, err and errArg. err and errArg are used for error handling when errors are generated.
Recommended Mitigation
function _isValidSignature(address receiver, bytes32 digest, uint8 v, bytes32 r, bytes32 s)
internal
pure
returns (bool)
{
- (address actualSigner,,) = ECDSA.tryRecover(digest, v, r, s);
+ (address actualSigner, RecoverError err, bytes32 errArg) = ECDSA.tryRecover(digest, v, r, s);
+ if (err) {
+ revert();
+ }
return actualSigner == receiver;
}
Rewards breakdown
nSLOC
215This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.