The getMaxTreeBrackets function does not handle the case when the suffixes array cannot be created due to memory constraints.

[code423n4]

Lines of code

https://github.com/ProjectOpenSea/seaport/blob/5de7302bc773d9821ba4759e47fc981680911ea0/contracts/lib/TypehashDirectory.sol#L99

Vulnerability details

Impact

if MaxTreeHeight is set to a very large value, such as 10^9, and twoSubstringLength is also set to a large value, such as 100, then the suffixes array would require (10^9) * (100) bytes of memory to be created. If the contract does not have that much memory available, the array would not be able to be created and the function would throw an out of memory error.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

contract OutOfMemory {

function test() public {

    bytes memory suffixes = new bytes(10**9 * 100);

}

}

Tools Used

vs code, hardhat

Recommended Mitigation Steps

This contract will throw an out of memory error because it's trying to allocate 100GB of memory which is not possible.

It's important to handle this case by either using a require statement to check the available memory before creating the array or using a dynamic array which only allocate the memory needed.

[0age]

contested; This would cause the Seaport deployment to fail if it were wrong (it's literally run in the constructor)

[HickupHH3]

Agreed.

[c4-judge]

HickupHH3 marked the issue as unsatisfactory: Insufficient quality