Open code423n4 opened 1 year ago
OpenCoreCH marked the issue as sponsor confirmed
Extreme edge case with a string that's technically valid, but semantically meaningless. But it's technically true.
0xleastwood marked the issue as primary issue
0xleastwood marked the issue as selected for report
Lines of code
https://github.com/code-423n4/2023-03-canto-identity/blob/main/canto-bio-protocol/src/Bio.sol#L60-L95
Vulnerability details
Impact
The Bio
tokenURI
function splits biography text into lines. The algorithm will take into account certain "continuation" characters to prevent splitting the line in the middle of these characters and keep accumulating those in the current line buffer (bytesLines
):https://github.com/code-423n4/2023-03-canto-identity/blob/main/canto-bio-protocol/src/Bio.sol#L60-L95
However, if the unicode string is a sequence of these continuation characters (which is a valid UTF8 string) the line buffer (which is 80 bytes) will eventually overflow and will revert the transaction due to an index of out bounds exception.
Proof of Concept
In the following test we use a string with 21 U+1F3FE characters to overflow the line buffer and revert the query to
tokenURI
.Note: the snippet shows only the relevant code for the test. Full test file can be found here.
Recommendation
Change to a new line when the current line buffer is full.