Open code423n4 opened 1 year ago
0xSorryNotSorry marked the issue as primary issue
AustinGreen marked the issue as sponsor acknowledged
AustinGreen marked the issue as disagree with severity
Acknowledge but this should be of informational severity. It is extremely unlikely and there is no risk to Llama users.
gzeon-c4 changed the severity to QA (Quality Assurance)
gzeon-c4 marked the issue as grade-c
gzeon-c4 marked the issue as grade-b
Lines of code
https://github.com/code-423n4/2023-06-llama/blob/aac904d31639c1b4b4e97f1c76b9c0f40b8e5cee/src/LlamaPolicyMetadata.sol#L109
Vulnerability details
LlamaPolicyMetadata.contractURI()
returns the contract URI for a given Llama policy, which gives the JSON data with the bio and generated svg image.There is no checks on
name
upon deployment. If it contains double-quotes"
,contractURI()
will return a corrupted string.Impact
If the
name
string has"
character, it can either:"name": "Llama Policies:
and"description": "This collection includes all members of the Llama organization:"
properties of thecontractURI
. For instance, by using the following name string:""name": "New Policy", "description": "new description""
, thename
anddescription
properties parsed from the JSON object would be"name": "New Policy", "description": "new description"
, as opposed to the "Llama Policies:..." and "description": "This collection includes all members of the Llama organization:..." expected. (Note: this depends on what JSON parsing method is used, but in general the handling of key-value pair will overwrite the value if the same key is encountered multiple times.).Tools Used
Manual Analysis
Recommended Mitigation Steps
Use the
escapeJSON
function fromLibString
to prevent the issue described above.Assessed type
Other