Egis-Security / CTF_Challenge

Repository containing CTF challenges from nmirchev8, deth and bOgO.
14 stars 8 forks source link

nmirchev8_ctf - Incorrect returnData parsing causes reverts for returns smaller than maxReturnDataBytes and calls that revert #34

Open highskore opened 3 months ago

highskore commented 3 months ago

Currently it's always seting returndata length as maxReturnDataBytes, which causes OutOfOffset reverts when returndatasize is < max (for > max we don't care because that's the whole point of avoiding gas bombs). This also happens if a revert happened in the external call.

This causes this contract to be unusable for calls that revert and have returndata < 64 bytes. Meaning that it denies the main functionality of the contract

      // Store the length of the copied bytes
      mstore(retData, maxReturnDataBytes)
      // copy the bytes from retData[0:maxReturnDataBytes]
      returndatacopy(add(retData, 0x20), 0x0, maxReturnDataBytes)

Fix:

    // Check return size
    let _returnSize := returndatasize()
    // If return size is > maxReturn, cap it to max
    if gt(_returnSize, maxReturnDataBytes) {
      _returnSize := maxReturnDataBytes
    }
    // Store the length of the copied bytes
    mstore(retData, _returnSize)
    // copy the bytes from retData[0:_returnSize]
    returndatacopy(add(retData, 0x20), 0x0, _returnSize)