Root + Impact
Description
-
The memory address 0x00 is used to save temporary variables. This memory shouldn't be used as it is a reserved space by the EVM. Instead should be used the memory addressed by the pointer in 0x40.
-
Below are mentioned the places where it happens:
function totalSupply_() internal view returns (uint256) {
assembly {
let slot := _totalSupply.slot
let supply := sload(slot)
@> mstore(0x00, supply)
return(0x00, 0x20)
}
}
function _approve(address owner, address spender, uint256 value) internal virtual returns (bool success) {
assembly ("memory-safe") {
if iszero(owner) {
@> mstore(0x00, shl(224, 0xe602df05))
mstore(add(0x00, 4), owner)
revert(0x00, 0x24)
}
if iszero(spender) {
@> mstore(0x00, shl(224, 0x94280d62))
mstore(add(0x00, 4), spender)
revert(0x00, 0x24)
}
.
.
.
success := 1
@> mstore(0x00, value)
log3(0x00, 0x20, 0x8c5be1e5ebec7d5bd14f71427d1e84f3dd0314c0f7b2291e5b200ac8c7c3b925, owner, spender)
}
}
function _transfer(address from, address to, uint256 value) internal returns (bool success) {
assembly ("memory-safe") {
if iszero(from) {
@> mstore(0x00, shl(224, 0x96c6fd1e))
mstore(add(0x00, 4), 0x00)
revert(0x00, 0x24)
}
if iszero(to) {
@> mstore(0x00, shl(224, 0xec442f05))
mstore(add(0x00, 4), 0x00)
revert(0x00, 0x24)
}
.
.
.
if lt(fromAmount, value) {
@> mstore(0x00, shl(224, 0xe450d38c))
mstore(add(0x00, 4), from)
mstore(add(0x00, 0x24), fromAmount)
mstore(add(0x00, 0x44), value)
revert(0x00, 0x64)
}
function _mint(address account, uint256 value) internal {
assembly ("memory-safe") {
if iszero(account) {
@> mstore(0x00, shl(224, 0xec442f05))
mstore(add(0x00, 4), 0x00)
revert(0x00, 0x24)
}
.
.
.
function _burn(address account, uint256 value) internal {
assembly ("memory-safe") {
if iszero(account) {
@> mstore(0x00, shl(224, 0x96c6fd1e))
mstore(add(0x00, 4), 0x00)
revert(0x00, 0x24)
}
function _spendAllowance(address owner, address spender, uint256 value) internal virtual {
.
.
.
if lt(currentAllowance, value) {
@> mstore(0x00, shl(224, 0xfb8f41b2))
mstore(add(0x00, 4), spender)
mstore(add(0x00, 0x24), currentAllowance)
mstore(add(0x00, 0x44), value)
revert(0, 0x64)
}
sstore(allowanceSlot, sub(currentAllowance, value))
}
}
Risk
Likelihood:
Impact:
Recommended Mitigation
Remove the code whenever the memory space 0x00 is used an instead use the corresponding pointer.
function totalSupply_() internal view returns (uint256) {
assembly {
let slot := _totalSupply.slot
let supply := sload(slot)
- mstore(0x00, supply)
- return(0x00, 0x20)
+ let ptr := mload(0x40)
+ return(ptr, 0x20)
}
}
