Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use of Solidity version 0.8.13 which has two known issues applicable to PuttyV2 #348

Open
code423n4 opened this issue Jul 4, 2022 · 3 comments · Fixed by outdoteth/putty-v2#6
Open

Use of Solidity version 0.8.13 which has two known issues applicable to PuttyV2 #348

code423n4 opened this issue Jul 4, 2022 · 3 comments · Fixed by outdoteth/putty-v2#6
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working old-submission-method resolved Finding has been patched by sponsor (sponsor pls link to PR containing fix) sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")

Comments

@code423n4
Copy link
Contributor

Lines of code

https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L2

Vulnerability details

The solidity version 0.8.13 has below two issues applicable to PuttyV2

  1. Vulnerability related to ABI-encoding.
    ref : https://blog.soliditylang.org/2022/05/18/solidity-0.8.14-release-announcement/
    This vulnerability can be misused since the function hashOrder() and hashOppositeOrder() has applicable conditions.
    "...pass a nested array directly to another external function call or use abi.encode on it."

  2. Vulnerability related to 'Optimizer Bug Regarding Memory Side Effects of Inline Assembly'
    ref : https://blog.soliditylang.org/2022/06/15/solidity-0.8.15-release-announcement/
    PuttyV2 inherits solidity contracts from openzeppelin and solmate, and both these uses inline assembly, and optimization is enabled while compiling.

Recommended Mitigation Steps

Use recent Solidity version 0.8.15 which has the fix for these issues
@code423n4 code423n4 added 2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working old-submission-method labels Jul 4, 2022
code423n4 added a commit that referenced this issue Jul 4, 2022
@code423n4
hubble issue #348
43bb3fc
@outdoteth
Copy link
Collaborator

great catch.

This was referenced Jul 7, 2022
Open
Open
@outdoteth
Copy link
Collaborator

Report: Use of solidity 0.8.13 with known issues in ABI encoding and memory side effects

@outdoteth outdoteth added the sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity") label Jul 8, 2022
@outdoteth outdoteth mentioned this issue Jul 14, 2022
Merged
@HickupHH3 HickupHH3 mentioned this issue Jul 14, 2022
Closed
@outdoteth
Copy link
Collaborator

PR with fix: outdoteth/putty-v2#6

@outdoteth outdoteth added the resolved Finding has been patched by sponsor (sponsor pls link to PR containing fix) label Jul 15, 2022
@HickupHH3 HickupHH3 mentioned this issue Jul 15, 2022
Closed
@github-actions github-actions bot mentioned this issue Nov 16, 2022
Closed
@CanonicalJP CanonicalJP mentioned this issue Feb 14, 2024
Closed
@sherlock-admin2 sherlock-admin2 mentioned this issue Aug 30, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
2 (Med Risk) Assets not at direct risk, but function/availability of the protocol could be impacted or leak value bug Something isn't working old-submission-method resolved Finding has been patched by sponsor (sponsor pls link to PR containing fix) sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")
Projects
None yet
Milestone
No milestone
2 participants
@outdoteth @code423n4