search

code-423n4 / 2023-11-zetachain-findings

0 stars 0 forks source link

[M-01] SIMILAR CONTRACT LIBRARY NAMES in ZetaInterfaces and ZetaConnectorZEVM #4

Closed c4-submissions closed 1 year ago

c4-submissions commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-11-zetachain/blob/44c8dd426e829536850b5d42b3f0ade1ce29a23c/repos/protocol-contracts/contracts/evm/interfaces/ZetaInterfaces.sol#L4-L47 https://github.com/code-423n4/2023-11-zetachain/blob/44c8dd426e829536850b5d42b3f0ade1ce29a23c/repos/protocol-contracts/contracts/zevm/ZetaConnectorZEVM.sol#L4-L47

Vulnerability details

Impact

When you compile a Solidity codebase, the compiler generates compilation artifacts, which include information about the contracts and their bytecode. If there are two contracts with the same name, the compiler will encounter a naming conflict and will not be able to generate compilation artifacts for both contracts.

Proof of Concept

Vulnerable Contract Libraries

// repos/protocol-contracts/contracts/evm/interfaces/ZetaInterfaces.sol#L4-L47
interface ZetaInterfaces {

// repos/protocol-contracts/contracts/zevm/ZetaConnectorZEVM.sol#L4-L47
interface ZetaInterfaces {

Tools Used

VS Code.

Recommended Mitigation Steps

To resolve this issue, you need to ensure that all contracts within your codebase have unique names. Renaming one of the contracts to have a distinct name will allow the compiler to generate compilation artifacts for both contracts successfully.

Assessed type

Library

code423n4 commented 1 year ago

Withdrawn by debo