Custom Ether Address Representation in Shell Protocol's Constructor

[c4-bot-2]

Lines of code

https://github.com/code-423n4/2023-11-shellprotocol/blob/485de7383cdf88284ee6bcf2926fb7c19e9fb257/src/adapters/CurveTricryptoAdapter.sol#L100

Vulnerability details

Impact

The hardcoded custom representation of Ether in the Shell Protocol's adapter for the Curve Tricrypto pool (using address(0x4574686572)), deviates from standard Ethereum practices and introduces the risk of address collisions. This could potentially lead to operational issues within the protocol, such as incorrect token handling or unintended interactions with other contracts.

Proof of Concept

The specific concern is that the custom Ether address might coincidentally match an actual Ethereum contract address due to the probabilistic nature of Ethereum address generation. This can result in:

• Users interacting with the Shell Protocol expecting to deal with Ether, but their transactions are inadvertently routed to a different contract that shares the same address.

Tools Used

Recommended Mitigation Steps

• Utilize a Unique Owned Address: Ensure the custom Ether address used in the Shell Protocol is a unique address already owned or controlled by the protocol. This minimizes the risk of collision with other Ethereum addresses.
• Monitor for Address Collisions: Regularly monitor the Ethereum network for potential address collisions, especially with newly deployed contracts, to ensure the chosen custom address remains unique and collision-free.

Assessed type

Access Control

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as primary issue

[raymondfam]

It's simply hexadecimal(ascii("Ether")), no address is entailed.

[c4-judge]

0xA5DF marked the issue as unsatisfactory: Invalid

[0xA5DF]

The specific concern is that the custom Ether address might coincidentally match an actual Ethereum contract address due to the probabilistic nature of Ethereum address generation.

This is as likely as finding the private key to the zero address