Token-0x
First Flight #54
Beginner FriendlyDeFi
100 EXP
View all submissions
Previous Next
Submission Details
Impact: high
Likelihood: medium

Writing to reserved memory leads to unexpected behavior

Author Revealed upon completion

Description

There are several mstore calls in contract ERC20 that use address 0x00 to store data. This must be avoided since addresses lower than 0x40 are reserved by Solidity and writing directly to this memory ma affect contract execution.

There are several occurrences. For example, in function totalSupply_():

function totalSupply_() internal view returns (uint256) {
assembly {
let slot := _totalSupply.slot
let supply := sload(slot)
@> mstore(0x00, supply)
return(0x00, 0x20)
}
}

Also, it is encountered in functions _approve, _transfer, _mint, _burn and _spendAllowance.

Risk

Likelihood: Medium

Probability that it will affect the contract execution depends on the execution flow and does not always happen.

Impact: High

The contract behavior can be unexpected.

Recommended Mitigation

Use memory addresses starting from a valid memory location, such as the one indicated by mload(0x40).

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!